Commit 0147ebcf authored by Colin Ian King's avatar Colin Ian King Committed by Doug Ledford

IB/core: fix null pointer deref and mem leak in error handling

The current error handling in setup_hw_stats has a couple of issues.
It is possible to generate a null pointer deference on the
kfree of hsag->attrs[i] because two of the early error exit paths
jump to the kfree when hsags NULL and not allocated. Fix this by
moving the kfree on stats and jumping to that, avoiding the hsag
freeing.

Secondly, there is a memory leak of stats if the hsag allocation
fails; instead of returning, jump to the kfree on stats.
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent da1f857b
...@@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port, ...@@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return; return;
if (!stats->names || stats->num_counters <= 0) if (!stats->names || stats->num_counters <= 0)
goto err; goto err_free_stats;
hsag = kzalloc(sizeof(*hsag) + hsag = kzalloc(sizeof(*hsag) +
// 1 extra for the lifespan config entry // 1 extra for the lifespan config entry
sizeof(void *) * (stats->num_counters + 1), sizeof(void *) * (stats->num_counters + 1),
GFP_KERNEL); GFP_KERNEL);
if (!hsag) if (!hsag)
return; goto err_free_stats;
ret = device->get_hw_stats(device, stats, port_num, ret = device->get_hw_stats(device, stats, port_num,
stats->num_counters); stats->num_counters);
...@@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port, ...@@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return; return;
err: err:
kfree(stats);
for (; i >= 0; i--) for (; i >= 0; i--)
kfree(hsag->attrs[i]); kfree(hsag->attrs[i]);
kfree(hsag); kfree(hsag);
err_free_stats:
kfree(stats);
return; return;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment