From 6d1833b44b7cdea6c8459df8c431f1779afa2ab8 Mon Sep 17 00:00:00 2001 From: yieux Date: Mon, 27 Nov 2023 15:29:30 +0800 Subject: [PATCH] fix memory leak bug in sc analyze unit --- README.md | 2 +- .../core/analyze_unit/secDetector_save_check.c | 15 +++++++++------ 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index a2b7726..9658879 100644 --- a/README.md +++ b/README.md @@ -68,7 +68,7 @@ secDetector在架构上分为四个部分：SDK、Service、检测特性集合ca 检测框架core是以一个cases依赖的基础框架，提供case的管理，和workflow所需的通用的基础功能单元。内核异常信息检测框架会以内核模块ko的形态承载。一个检测特性case可以将自己注册到框架中，或者从框架中去注册。框架还可以提供特定的交互接口以满足外部的动态请求。一个workflow被定义为有四类功能单元组成：事件发生器、信息采集器、事件分析器、响应单元。 - +Driver分为两类，kerneldriver 和 usrdriver。顾名思义，kerneldriver是部署在内核态中的，以内核模块的形式承载。usrdriver是部署在用户态中的，直接被部署为Service中的一个模块。从逻辑上usrdriver是在Service之下的，但是在运行中，为了降低通信成本，usrdriver被直接集成在Service程序中。 ## 安装教程 - kerneldriver diff --git a/kerneldriver/core/analyze_unit/secDetector_save_check.c b/kerneldriver/core/analyze_unit/secDetector_save_check.c index 101a028..72c4948 100644 --- a/kerneldriver/core/analyze_unit/secDetector_save_check.c +++ b/kerneldriver/core/analyze_unit/secDetector_save_check.c @@ -129,7 +129,8 @@ static int analyze_save_check_normal(struct list_head *collect_data_list, analyz response_arrays[response_array_index] = kmalloc(strlen(cd->name) + REPORT_MORE_CHAR_LEN, GFP_KERNEL); if (response_arrays[response_array_index] == NULL) { pr_err("kmalloc failed"); - return -ENOMEM; + ret = -ENOMEM; + goto end; } strcpy(response_arrays[response_array_index], "[save_check]"); @@ -155,20 +156,22 @@ static int analyze_save_check_normal(struct list_head *collect_data_list, analyz timestamp_len = get_timestamp_str(×tamp); response_data->report_data.type = event_type; response_data->report_data.len = response_data_char_len + timestamp_len; - response_data->report_data.text = kmalloc(response_data_char_len + 1, GFP_KERNEL); + response_data->report_data.text = kmalloc(response_data->report_data.len + 1, GFP_KERNEL); if (response_data->report_data.text == NULL) { pr_err("kmalloc failed"); - return -ENOMEM; + ret = -ENOMEM; + goto end; } if (timestamp_len > 0) { strncat(response_data->report_data.text, timestamp, timestamp_len); kfree(timestamp); } - for (i = 0; i < response_array_index; i++) { + for (i = 0; i < response_array_index; i++) strncat(response_data->report_data.text, response_arrays[i], strlen(response_arrays[i])); - kfree(response_arrays[i]); - } } +end: + for (i = 0; i < response_array_index; i++) + kfree(response_arrays[i]); kfree(response_arrays); return ret; -- Gitee