summaryrefslogtreecommitdiff
path: root/drivers/infiniband/core
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2016-06-01 21:06:36 +0300
committerDoug Ledford <dledford@redhat.com>2016-06-07 02:22:18 +0300
commit0147ebcf8927f09e1923114092f6b14c1de75a95 (patch)
treef11bcfbdf15e37a0998c16ebdde94ad070448350 /drivers/infiniband/core
parentda1f857be62ca0472024da37eab068b3b8ce0a15 (diff)
downloadlinux-0147ebcf8927f09e1923114092f6b14c1de75a95.tar.xz
IB/core: fix null pointer deref and mem leak in error handling
The current error handling in setup_hw_stats has a couple of issues. It is possible to generate a null pointer deference on the kfree of hsag->attrs[i] because two of the early error exit paths jump to the kfree when hsags NULL and not allocated. Fix this by moving the kfree on stats and jumping to that, avoiding the hsag freeing. Secondly, there is a memory leak of stats if the hsag allocation fails; instead of returning, jump to the kfree on stats. Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/core')
-rw-r--r--drivers/infiniband/core/sysfs.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 5e573bb18660..ed04a7bd4481 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return;
if (!stats->names || stats->num_counters <= 0)
- goto err;
+ goto err_free_stats;
hsag = kzalloc(sizeof(*hsag) +
// 1 extra for the lifespan config entry
sizeof(void *) * (stats->num_counters + 1),
GFP_KERNEL);
if (!hsag)
- return;
+ goto err_free_stats;
ret = device->get_hw_stats(device, stats, port_num,
stats->num_counters);
@@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
return;
err:
- kfree(stats);
for (; i >= 0; i--)
kfree(hsag->attrs[i]);
kfree(hsag);
+err_free_stats:
+ kfree(stats);
return;
}