Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1331776

Re: [PATCH 3/5] net/mlx4: fix some error handling in mlx4_multi_func_init()

Show all headers | View raw

On Wed, 10 Feb 2016 19:15:20 +0100
Rasmus Villemoes <linux@rasmusvillemoes.dk> wrote:

> On Wed, Feb 10 2016, Yishai Hadas <yishaih@dev.mellanox.co.il> wrote:
> 
> >> @@ -2429,7 +2429,7 @@ err_thread:
> >>   	flush_workqueue(priv->mfunc.master.comm_wq);
> >>   	destroy_workqueue(priv->mfunc.master.comm_wq);
> >>   err_slaves:
> >> -	while (--i) {
> >> +	while (i--) {
> >
> > This fix is wrong as it hits the case that i arrived the last value
> > then below code will access to a non valid entry in the array.
> >
> > The expected fix should be:
> > while (--i >= 0)
> >
> 
> Huh? They're completely equivalent (given that i is necessarily
> non-negative before we evaluate the loop condition)

No, they are not equivalent.
if i == the max value (dev->num_slaves) when entering your proposed
while loop, the kfree call index (i) will be out of range!  This can
happen, for example, if the failure occurs downstream from the "i"
for-loop (e.g., if the call to mlx4_init_resource_tracker() fails).

Therefore, we DO require the pre-decrement format.  Therefore, the
one-line fix proposed by Yishai is the correct fix.
>. I don't really
> care either way, but git grep says that 'while (i--)' is 5 times more
> common than 'while (--i >= 0)'.
Not relevant, while (i--) is simply not correct, because of the case
where the for-loop involving i completes successfully and an error
occurs later.

FYI, you also had another bug in your solution -- a double-free when
kzalloc for port 2 fails.  For your code, you should also have reset
s_state->vlan_filter[port] to NULL as shown below:
			for (port = 1; port <= MLX4_MAX_PORTS; port++) {
				struct mlx4_vport_state *admin_vport;
				struct mlx4_vport_state *oper_vport;

				s_state->vlan_filter[port] =
					kzalloc(sizeof(struct
				mlx4_vlan_fltr), GFP_KERNEL);
				if (!s_state->vlan_filter[port]) {
					if (--port) {
 						kfree(s_state->vlan_filter[port]);
	==> You should have added this		s_state->vlan_filter[port] = NULL;
					}
					goto err_slaves;
				}

However, again, the correct solution is to do what Yishai suggests:
	while (--i >= 0)
so that if i is already zero the while-loop will not be entered.

-Jack
> 
> Rasmus
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma"
> in the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/5] pre-decrement in error paths considered harmful Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-02-09 21:20 +0100
  [PATCH 5/5] mm/backing-dev.c: fix error path in wb_init() Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-02-09 21:20 +0100
  [PATCH 4/5] net: sxgbe: fix error paths in sxgbe_platform_probe() Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-02-09 21:20 +0100
  [PATCH 1/5] drm/gma500: fix error path in gma_intel_setup_gmbus() Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-02-09 21:20 +0100
    Re: [PATCH 1/5] drm/gma500: fix error path in gma_intel_setup_gmbus() Andy Shevchenko <andy.shevchenko@gmail.com> - 2016-02-10 07:50 +0100
      Re: [PATCH 1/5] drm/gma500: fix error path in gma_intel_setup_gmbus() Daniel Vetter <daniel@ffwll.ch> - 2016-02-10 08:30 +0100
  [PATCH 3/5] net/mlx4: fix some error handling in mlx4_multi_func_init() Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-02-09 21:20 +0100
    Re: [PATCH 3/5] net/mlx4: fix some error handling in  mlx4_multi_func_init() Yishai Hadas <yishaih@dev.mellanox.co.il> - 2016-02-10 10:50 +0100
      Re: [PATCH 3/5] net/mlx4: fix some error handling in mlx4_multi_func_init() Rasmus Villemoes <linux@rasmusvillemoes.dk> - 2016-02-10 19:20 +0100
        Re: [PATCH 3/5] net/mlx4: fix some error handling in  mlx4_multi_func_init() Jack Morgenstein <jackm@dev.mellanox.co.il> - 2016-02-11 10:30 +0100
          Re: [PATCH 3/5] net/mlx4: fix some error handling in  mlx4_multi_func_init() Jack Morgenstein <jackm@dev.mellanox.co.il> - 2016-02-11 11:30 +0100
    Re: [PATCH 3/5] net/mlx4: fix some error handling in  mlx4_multi_func_init() Doug Ledford <dledford@redhat.com> - 2016-02-11 17:10 +0100

csiph-web