3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ulf Magnusson <ulfali...@gmail.com>

[ Upstream commit ae7440ef0c8013d68c00dad6900e7cce5311bb1c ]

expr_trans_compare() always allocates and returns a new expression,
giving the following leak outline:

        ...
        *Allocate*
        basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no);
        ...
        for (menu = parent->next; menu; menu = menu->next) {
                ...
                *Copy*
                dep2 = expr_copy(basedep);
                ...
                *Free copy*
                expr_free(dep2);
        }
        *basedep lost!*

Fix by freeing 'basedep' after the loop.

Summary from Valgrind on 'menuconfig' (ARCH=x86) before the fix:

        LEAK SUMMARY:
           definitely lost: 344,376 bytes in 14,349 blocks
           ...

Summary after the fix:

        LEAK SUMMARY:
           definitely lost: 44,448 bytes in 1,852 blocks
           ...

Signed-off-by: Ulf Magnusson <ulfali...@gmail.com>
Signed-off-by: Masahiro Yamada <yamada.masah...@socionext.com>
Signed-off-by: Sasha Levin <alexander.le...@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 scripts/kconfig/menu.c |    1 +
 1 file changed, 1 insertion(+)

--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -364,6 +364,7 @@ void menu_finalize(struct menu *parent)
                        menu->parent = parent;
                        last_menu = menu;
                }
+               expr_free(basedep);
                if (last_menu) {
                        parent->list = parent->next;
                        parent->next = last_menu->next;


Reply via email to