Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1411440 > unrolled thread

[PATCH] IB/core: fix null pointer dereference and memory leak in error handling

Back to article view | Back to linux.kernel

Contents

  [PATCH] IB/core: fix null pointer dereference and memory leak in error handling Colin King <colin.king@canonical.com> - 2016-06-01 20:10 +0200
    Re: [PATCH] IB/core: fix null pointer dereference and memory leak in  error handling Doug Ledford <dledford@redhat.com> - 2016-06-07 01:30 +0200

#1411440 — [PATCH] IB/core: fix null pointer dereference and memory leak in error handling

From: Colin Ian King <colin.king@canonical.com>

The current error handling in setup_hw_stats has a couple of issues.
It is possible to generate a null pointer deference on the
kfree of hsag->attrs[i] because two of the early error exit paths
jump to the kfree when hsags NULL and not allocated. Fix this by
moving the kfree on stats and jumping to that, avoiding the hsag
freeing.

Secondly, there is a memory leak of stats if the hsag allocation
fails; instead of returning, jump to the kfree on stats.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/infiniband/core/sysfs.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 5e573bb..ed04a7b 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
 		return;
 
 	if (!stats->names || stats->num_counters <= 0)
-		goto err;
+		goto err_free_stats;
 
 	hsag = kzalloc(sizeof(*hsag) +
 		       // 1 extra for the lifespan config entry
 		       sizeof(void *) * (stats->num_counters + 1),
 		       GFP_KERNEL);
 	if (!hsag)
-		return;
+		goto err_free_stats;
 
 	ret = device->get_hw_stats(device, stats, port_num,
 				   stats->num_counters);
@@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
 	return;
 
 err:
-	kfree(stats);
 	for (; i >= 0; i--)
 		kfree(hsag->attrs[i]);
 	kfree(hsag);
+err_free_stats:
+	kfree(stats);
 	return;
 }
 
-- 
2.8.1

[toc] | [next] | [standalone]

#1415574 — Re: [PATCH] IB/core: fix null pointer dereference and memory leak in error handling

[Multipart message — attachments visible in raw view] — view raw

On 6/1/2016 2:06 PM, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> The current error handling in setup_hw_stats has a couple of issues.
> It is possible to generate a null pointer deference on the
> kfree of hsag->attrs[i] because two of the early error exit paths
> jump to the kfree when hsags NULL and not allocated. Fix this by
> moving the kfree on stats and jumping to that, avoiding the hsag
> freeing.
> 
> Secondly, there is a memory leak of stats if the hsag allocation
> fails; instead of returning, jump to the kfree on stats.
> 
> Signed-off-by: Colin Ian King <colin.king@canonical.com>

Thanks, applied.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web