leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

IB/core: fix null pointer deref and mem leak in error handling

Browse Source 
The current error handling in setup_hw_stats has a couple of issues.
It is possible to generate a null pointer deference on the
kfree of hsag->attrs[i] because two of the early error exit paths
jump to the kfree when hsags NULL and not allocated. Fix this by
moving the kfree on stats and jumping to that, avoiding the hsag
freeing.

Secondly, there is a memory leak of stats if the hsag allocation
fails; instead of returning, jump to the kfree on stats.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
This commit is contained in:
Colin Ian King 2016-06-01 19:06:36 +01:00 committed by Doug Ledford
parent da1f857be6
commit 0147ebcf89
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/infiniband/core/sysfs.c
View File

@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return;
if (!stats->names || stats->num_counters <= 0)
goto err;
goto err_free_stats;
hsag = kzalloc(sizeof(*hsag) +
// 1 extra for the lifespan config entry
sizeof(void *) * (stats->num_counters + 1),
GFP_KERNEL);
if (!hsag)
return;
goto err_free_stats;
ret = device->get_hw_stats(device, stats, port_num,
stats->num_counters);
@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return;
err:
kfree(stats);
for (; i >= 0; i--)
kfree(hsag->attrs[i]);
kfree(hsag);
err_free_stats:
kfree(stats);
return;
}