Commit 0147ebcf authored Jun 01, 2016 by Colin Ian King Committed by Doug Ledford Jun 06, 2016

IB/core: fix null pointer deref and mem leak in error handling



The current error handling in setup_hw_stats has a couple of issues.
It is possible to generate a null pointer deference on the
kfree of hsag->attrs[i] because two of the early error exit paths
jump to the kfree when hsags NULL and not allocated. Fix this by
moving the kfree on stats and jumping to that, avoiding the hsag
freeing.

Secondly, there is a memory leak of stats if the hsag allocation
fails; instead of returning, jump to the kfree on stats.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

parent da1f857b

drivers/infiniband/core/sysfs.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device device, struct ib_port port,
		return;

		if (!stats->names \|\| stats->num_counters <= 0)
		goto err;
		goto err_free_stats;

		hsag = kzalloc(sizeof(*hsag) +
		// 1 extra for the lifespan config entry
		sizeof(void ) (stats->num_counters + 1),
		GFP_KERNEL);
		if (!hsag)
		return;
		goto err_free_stats;

		ret = device->get_hw_stats(device, stats, port_num,
		stats->num_counters);
		@@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device device, struct ib_port port,
		return;

		err:
		kfree(stats);
		for (; i >= 0; i--)
		kfree(hsag->attrs[i]);
		kfree(hsag);
		err_free_stats:
		kfree(stats);
		return;
		}