If io_submit or io_getevents fails, the do_aio_rw() won't free the "buf" and cause memory leak. Signed-off-by: Zorro Lang <zlang@xxxxxxxxxx> --- ltp/fsstress.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/ltp/fsstress.c b/ltp/fsstress.c index a11206d4..410a2437 100644 --- a/ltp/fsstress.c +++ b/ltp/fsstress.c @@ -2099,8 +2099,7 @@ do_aio_rw(int opno, long r, int flags) if (!get_fname(FT_REGFILE, r, &f, NULL, NULL, &v)) { if (v) printf("%d/%d: do_aio_rw - no filename\n", procid, opno); - free_pathname(&f); - return; + goto aio_out3; } fd = open_path(&f, flags|O_DIRECT); e = fd < 0 ? errno : 0; @@ -2109,16 +2108,13 @@ do_aio_rw(int opno, long r, int flags) if (v) printf("%d/%d: do_aio_rw - open %s failed %d\n", procid, opno, f.path, e); - free_pathname(&f); - return; + goto aio_out3; } if (fstat64(fd, &stb) < 0) { if (v) printf("%d/%d: do_aio_rw - fstat64 %s failed %d\n", procid, opno, f.path, errno); - free_pathname(&f); - close(fd); - return; + goto aio_out2; } inode_info(st, sizeof(st), &stb, v); if (!iswrite && stb.st_size == 0) { @@ -2150,6 +2146,12 @@ do_aio_rw(int opno, long r, int flags) else if (len > diob.d_maxiosz) len = diob.d_maxiosz; buf = memalign(diob.d_mem, len); + if (!buf) { + if (v) + printf("%d/%d: do_aio_rw - memalign failed\n", + procid, opno); + goto aio_out2; + } if (iswrite) { off = (off64_t)(lr % MIN(stb.st_size + (1024 * 1024), MAXFSIZE)); @@ -2166,27 +2168,26 @@ do_aio_rw(int opno, long r, int flags) if (v) printf("%d/%d: %s - io_submit failed %d\n", procid, opno, iswrite ? "awrite" : "aread", e); - free_pathname(&f); - close(fd); - return; + goto aio_out1; } if ((e = io_getevents(io_ctx, 1, 1, &event, NULL)) != 1) { if (v) printf("%d/%d: %s - io_getevents failed %d\n", procid, opno, iswrite ? "awrite" : "aread", e); - free_pathname(&f); - close(fd); - return; + goto aio_out1; } e = event.res != len ? event.res2 : 0; - free(buf); if (v) printf("%d/%d: %s %s%s [%lld,%d] %d\n", procid, opno, iswrite ? "awrite" : "aread", f.path, st, (long long)off, (int)len, e); - free_pathname(&f); + aio_out1: + free(buf); + aio_out2: close(fd); + aio_out3: + free_pathname(&f); } #endif -- 2.20.1