Re: [RFC PATCH] RDMA/core: avoid potential memory leak in add_one_compat_dev

Re: [RFC PATCH] RDMA/core: avoid potential memory leak in add_one_compat_dev

[Guoqing Jiang]

Forget to cc list, sorry.

On 1/10/20 4:32 PM, jgq516@gmail.com wrote:
> From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
>
> In add_one_compat_dev, if failure happens after cdev is allocated,
> so we need to free the memory accordingly.
>
> Fixes: 4e0f7b9070726 ("RDMA/core: Implement compat device/sysfs tree in net namespace")
> Cc: Parav Pandit <parav@mellanox.com>
> Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
> ---
> Hi,
>
> When reading the code, it looks no place to free cdev under those err condition.
> And I guess remove_one_compat_dev needs to free cdev as well, something like:
>
> @@ -937,6 +937,8 @@ static void remove_one_compat_dev(struct ib_device *device, u32 id)
>                  ib_free_port_attrs(cdev);
>                  device_del(&cdev->dev);
>                  put_device(&cdev->dev);
> +               kfree(cdev);
> +               cdev = NULL;
>          }
>   }
>
> But since I am not know well about the code, so this is RFC.
>
> Thanks,
> Guoqing
>
>   drivers/infiniband/core/device.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
> index 84dd74fe13b8..dca8d9da4a75 100644
> --- a/drivers/infiniband/core/device.c
> +++ b/drivers/infiniband/core/device.c
> @@ -918,6 +918,7 @@ static int add_one_compat_dev(struct ib_device *device,
>   	device_del(&cdev->dev);
>   add_err:
>   	put_device(&cdev->dev);
> +	kfree(cdev);
>   cdev_err:
>   	xa_release(&device->compat_devs, rnet->id);
>   done:

Re: [RFC PATCH] RDMA/core: avoid potential memory leak in add_one_compat_dev

[Jason Gunthorpe]

On Fri, Jan 10, 2020 at 04:34:08PM +0100, Guoqing Jiang wrote:
> Forget to cc list, sorry.
> 
> On 1/10/20 4:32 PM, jgq516@gmail.com wrote:
> > From: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
> > 
> > In add_one_compat_dev, if failure happens after cdev is allocated,
> > so we need to free the memory accordingly.
> > 
> > Fixes: 4e0f7b9070726 ("RDMA/core: Implement compat device/sysfs tree in net namespace")
> > Cc: Parav Pandit <parav@mellanox.com>
> > Signed-off-by: Guoqing Jiang <guoqing.jiang@cloud.ionos.com>
> > Hi,
> > 
> > When reading the code, it looks no place to free cdev under those err condition.
> > And I guess remove_one_compat_dev needs to free cdev as well, something like:
> > 
> > @@ -937,6 +937,8 @@ static void remove_one_compat_dev(struct ib_device *device, u32 id)
> >                  ib_free_port_attrs(cdev);
> >                  device_del(&cdev->dev);
> >                  put_device(&cdev->dev);
> > +               kfree(cdev);
> > +               cdev = NULL;
> >          }
> >   }
> > 
> > But since I am not know well about the code, so this is RFC.

put_device triggers compatdev_release which does the free

Jason