[PATCH] RDMA/siw: fix a refcount leak in siw_newlink()

[PATCH] RDMA/siw: fix a refcount leak in siw_newlink()

[Tetsuo Handa]

siw_newlink() is leaking a refcount on "base_dev" when kzalloc() from
_ib_alloc_device() from ib_alloc_device() from siw_device_create()
returned NULL.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
---
I don't know whether this is a bug syzbot is currently reporting at
https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b .
Please check if this patch helps.

 drivers/infiniband/sw/siw/siw_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
index dacc174604bf..aefeda633655 100644
--- a/drivers/infiniband/sw/siw/siw_main.c
+++ b/drivers/infiniband/sw/siw/siw_main.c
@@ -522,6 +522,8 @@ static int siw_newlink(const char *basedev_name, struct net_device *netdev)
 		rv = siw_device_register(sdev, basedev_name);
 		if (rv)
 			ib_dealloc_device(&sdev->base_dev);
+	} else {
+		ib_device_put(base_dev);
 	}
 	return rv;
 }
-- 
2.18.4

RE: [PATCH] RDMA/siw: fix a refcount leak in siw_newlink()

[Bernard Metzler]

> -----Original Message-----
> From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Sent: Friday, 24 March 2023 12:29
> To: Bernard Metzler <BMT@zurich.ibm.com>; Jason Gunthorpe <jgg@ziepe.ca>;
> Leon Romanovsky <leon@kernel.org>
> Cc: OFED mailing list <linux-rdma@vger.kernel.org>
> Subject: [EXTERNAL] [PATCH] RDMA/siw: fix a refcount leak in siw_newlink()
> 
> siw_newlink() is leaking a refcount on "base_dev" when kzalloc() from
> _ib_alloc_device() from ib_alloc_device() from siw_device_create()
> returned NULL.
> 
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
> ---
> I don't know whether this is a bug syzbot is currently reporting at
> INVALID URI REMOVED
> 3A__syzkaller.appspot.com_bug-3Fextid-
> 3D5e70d01ee8985ae62a3b&d=DwICaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=2TaYXQ0T-
> r8ZO1PP1alNwU_QJcRRLfmYTAgd3QCvqSc&m=iWfr1_1-sQHBc2O6yqblp-xMSeLRa2v-
> tngiW42NaNMNkPeHRVUwsZHN8LJtraFl&s=X9ORgENvKm5kPVOc8GInXfK8aE5VeiSKR_-
> BB8iiT_A&e=  .
> Please check if this patch helps.
> 
>  drivers/infiniband/sw/siw/siw_main.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/siw/siw_main.c
> b/drivers/infiniband/sw/siw/siw_main.c
> index dacc174604bf..aefeda633655 100644
> --- a/drivers/infiniband/sw/siw/siw_main.c
> +++ b/drivers/infiniband/sw/siw/siw_main.c
> @@ -522,6 +522,8 @@ static int siw_newlink(const char *basedev_name, struct
> net_device *netdev)
>  		rv = siw_device_register(sdev, basedev_name);
>  		if (rv)
>  			ib_dealloc_device(&sdev->base_dev);
> +	} else {
> +		ib_device_put(base_dev);

base_dev is always NULL here, so nothing to put,
right?


>  	}
>  	return rv;
>  }
> --
> 2.18.4

Re: [PATCH] RDMA/siw: fix a refcount leak in siw_newlink()

[Tetsuo Handa]

On 2023/03/24 21:20, Bernard Metzler wrote:
>> @@ -522,6 +522,8 @@ static int siw_newlink(const char *basedev_name, struct
>> net_device *netdev)
>>  		rv = siw_device_register(sdev, basedev_name);
>>  		if (rv)
>>  			ib_dealloc_device(&sdev->base_dev);
>> +	} else {
>> +		ib_device_put(base_dev);
> 
> base_dev is always NULL here, so nothing to put,
> right?

Oops, indeed. Then, there is a leak somewhere else.

> 
> 
>>  	}
>>  	return rv;
>>  }
>> --
>> 2.18.4