summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2016-06-01 18:06:36 (GMT)
committerDoug Ledford <dledford@redhat.com>2016-06-06 23:22:18 (GMT)
commit0147ebcf8927f09e1923114092f6b14c1de75a95 (patch)
treef11bcfbdf15e37a0998c16ebdde94ad070448350
parentda1f857be62ca0472024da37eab068b3b8ce0a15 (diff)
downloadlinux-0147ebcf8927f09e1923114092f6b14c1de75a95.tar.xz
IB/core: fix null pointer deref and mem leak in error handling
The current error handling in setup_hw_stats has a couple of issues. It is possible to generate a null pointer deference on the kfree of hsag->attrs[i] because two of the early error exit paths jump to the kfree when hsags NULL and not allocated. Fix this by moving the kfree on stats and jumping to that, avoiding the hsag freeing. Secondly, there is a memory leak of stats if the hsag allocation fails; instead of returning, jump to the kfree on stats. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
-rw-r--r--drivers/infiniband/core/sysfs.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 5e573bb..ed04a7b 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return;
if (!stats->names || stats->num_counters <= 0)
- goto err;
+ goto err_free_stats;
hsag = kzalloc(sizeof(*hsag) +
// 1 extra for the lifespan config entry
sizeof(void *) * (stats->num_counters + 1),
GFP_KERNEL);
if (!hsag)
- return;
+ goto err_free_stats;
ret = device->get_hw_stats(device, stats, port_num,
stats->num_counters);
@@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return;
err:
- kfree(stats);
for (; i >= 0; i--)
kfree(hsag->attrs[i]);
kfree(hsag);
+err_free_stats:
+ kfree(stats);
return;
}