commit 1ae2293dd6d2f5c823cf97e60b70d03631cd622f
author Al Viro <viro@zeniv.linux.org.uk> Sat Sep 17 18:31:46 2016 -0400
committer Steven Rostedt <rostedt@goodmis.org> Sun Sep 25 13:30:13 2016 -0400
tree 1cd2b21bd5f6d29ba96ce66daa111cd38fd3aaed
parent 1245800c0f96eb6ebb368593e251d66c01e61022

fix memory leaks in tracing_buffers_splice_read()

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

kernel/trace/trace.c

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8fb4847..77eeab2 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5930,9 +5930,6 @@
 		return -EBUSY;
 #endif
 
-	if (splice_grow_spd(pipe, &spd))
-		return -ENOMEM;
-
 	if (*ppos & (PAGE_SIZE - 1))
 		return -EINVAL;
 
@@ -5942,6 +5939,9 @@
 		len &= PAGE_MASK;
 	}
 
+	if (splice_grow_spd(pipe, &spd))
+		return -ENOMEM;
+
  again:
 	trace_access_lock(iter->cpu_file);
 	entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file);
@@ -5999,19 +5999,21 @@
 	/* did we read anything? */
 	if (!spd.nr_pages) {
 		if (ret)
-			return ret;
+			goto out;
 
+		ret = -EAGAIN;
 		if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK))
-			return -EAGAIN;
+			goto out;
 
 		ret = wait_on_pipe(iter, true);
 		if (ret)
-			return ret;
+			goto out;
 
 		goto again;
 	}
 
 	ret = splice_to_pipe(pipe, &spd);
+out:
 	splice_shrink_spd(&spd);
 
 	return ret;