* [PATCH 1/2] IB/sysfs: fix NULL dereference
@ 2016-06-05 20:13 Sudip Mukherjee
2016-06-05 20:13 ` [PATCH 2/2] IB/sysfs: fix memory leak Sudip Mukherjee
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Sudip Mukherjee @ 2016-06-05 20:13 UTC (permalink / raw)
To: Doug Ledford, Sean Hefty, Hal Rosenstock
Cc: linux-kernel, linux-rdma, Sudip Mukherjee
If stats->names is NULL or stats->num_counters <= 0 we are jumping to
the error path where the for loop is freeing hsag->attrs[i]. But as i
is initialized to 0 so i >= 0 will be true and the loop will execute
once trying to free hsag->attrs[0]. But hsag is NULL still now leading
to a NULL pointer dereference.
Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
drivers/infiniband/core/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 5e573bb..fcf6f9c 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -891,7 +891,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
{
struct attribute_group *hsag = NULL;
struct rdma_hw_stats *stats;
- int i = 0, ret;
+ int i = -1, ret;
stats = device->alloc_hw_stats(device, port_num);
--
1.9.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH 2/2] IB/sysfs: fix memory leak
2016-06-05 20:13 [PATCH 1/2] IB/sysfs: fix NULL dereference Sudip Mukherjee
@ 2016-06-05 20:13 ` Sudip Mukherjee
2016-06-06 6:34 ` Leon Romanovsky
2016-06-07 11:50 ` Doug Ledford
2016-06-06 6:30 ` [PATCH 1/2] IB/sysfs: fix NULL dereference Leon Romanovsky
2016-06-07 11:48 ` Doug Ledford
2 siblings, 2 replies; 7+ messages in thread
From: Sudip Mukherjee @ 2016-06-05 20:13 UTC (permalink / raw)
To: Doug Ledford, Sean Hefty, Hal Rosenstock
Cc: linux-kernel, linux-rdma, Sudip Mukherjee
If the allocation of hsag fails we were just returning but stats was
not released.
Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
drivers/infiniband/core/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index fcf6f9c..8d8732c 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
sizeof(void *) * (stats->num_counters + 1),
GFP_KERNEL);
if (!hsag)
- return;
+ goto err;
ret = device->get_hw_stats(device, stats, port_num,
stats->num_counters);
--
1.9.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH 1/2] IB/sysfs: fix NULL dereference
2016-06-05 20:13 [PATCH 1/2] IB/sysfs: fix NULL dereference Sudip Mukherjee
2016-06-05 20:13 ` [PATCH 2/2] IB/sysfs: fix memory leak Sudip Mukherjee
@ 2016-06-06 6:30 ` Leon Romanovsky
2016-06-07 11:48 ` Doug Ledford
2 siblings, 0 replies; 7+ messages in thread
From: Leon Romanovsky @ 2016-06-06 6:30 UTC (permalink / raw)
To: Sudip Mukherjee
Cc: Doug Ledford, Sean Hefty, Hal Rosenstock, linux-kernel, linux-rdma
[-- Attachment #1: Type: text/plain, Size: 1344 bytes --]
On Sun, Jun 05, 2016 at 09:13:55PM +0100, Sudip Mukherjee wrote:
> If stats->names is NULL or stats->num_counters <= 0 we are jumping to
> the error path where the for loop is freeing hsag->attrs[i]. But as i
> is initialized to 0 so i >= 0 will be true and the loop will execute
> once trying to free hsag->attrs[0]. But hsag is NULL still now leading
> to a NULL pointer dereference.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Thanks,
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
> ---
> drivers/infiniband/core/sysfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index 5e573bb..fcf6f9c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -891,7 +891,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
> {
> struct attribute_group *hsag = NULL;
> struct rdma_hw_stats *stats;
> - int i = 0, ret;
> + int i = -1, ret;
>
> stats = device->alloc_hw_stats(device, port_num);
>
> --
> 1.9.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 2/2] IB/sysfs: fix memory leak
2016-06-05 20:13 ` [PATCH 2/2] IB/sysfs: fix memory leak Sudip Mukherjee
@ 2016-06-06 6:34 ` Leon Romanovsky
2016-06-06 12:17 ` Leon Romanovsky
2016-06-07 11:50 ` Doug Ledford
1 sibling, 1 reply; 7+ messages in thread
From: Leon Romanovsky @ 2016-06-06 6:34 UTC (permalink / raw)
To: Sudip Mukherjee
Cc: Doug Ledford, Sean Hefty, Hal Rosenstock, linux-kernel, linux-rdma
[-- Attachment #1: Type: text/plain, Size: 1141 bytes --]
On Sun, Jun 05, 2016 at 09:13:56PM +0100, Sudip Mukherjee wrote:
> If the allocation of hsag fails we were just returning but stats was
> not released.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Thanks,
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
> ---
> drivers/infiniband/core/sysfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index fcf6f9c..8d8732c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
> sizeof(void *) * (stats->num_counters + 1),
> GFP_KERNEL);
> if (!hsag)
> - return;
> + goto err;
>
> ret = device->get_hw_stats(device, stats, port_num,
> stats->num_counters);
> --
> 1.9.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 2/2] IB/sysfs: fix memory leak
2016-06-06 6:34 ` Leon Romanovsky
@ 2016-06-06 12:17 ` Leon Romanovsky
0 siblings, 0 replies; 7+ messages in thread
From: Leon Romanovsky @ 2016-06-06 12:17 UTC (permalink / raw)
To: Sudip Mukherjee
Cc: Doug Ledford, Sean Hefty, Hal Rosenstock, linux-kernel, linux-rdma
[-- Attachment #1: Type: text/plain, Size: 1400 bytes --]
On Mon, Jun 06, 2016 at 09:34:54AM +0300, Leon Romanovsky wrote:
> On Sun, Jun 05, 2016 at 09:13:56PM +0100, Sudip Mukherjee wrote:
> > If the allocation of hsag fails we were just returning but stats was
> > not released.
> >
> > Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
>
> Thanks,
> Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
It looks the same as Colin's patch which was sent a week ago.
http://marc.info/?l=linux-kernel&m=146480441931189&w=2
>
> > ---
> > drivers/infiniband/core/sysfs.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> > index fcf6f9c..8d8732c 100644
> > --- a/drivers/infiniband/core/sysfs.c
> > +++ b/drivers/infiniband/core/sysfs.c
> > @@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
> > sizeof(void *) * (stats->num_counters + 1),
> > GFP_KERNEL);
> > if (!hsag)
> > - return;
> > + goto err;
> >
> > ret = device->get_hw_stats(device, stats, port_num,
> > stats->num_counters);
> > --
> > 1.9.1
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 1/2] IB/sysfs: fix NULL dereference
2016-06-05 20:13 [PATCH 1/2] IB/sysfs: fix NULL dereference Sudip Mukherjee
2016-06-05 20:13 ` [PATCH 2/2] IB/sysfs: fix memory leak Sudip Mukherjee
2016-06-06 6:30 ` [PATCH 1/2] IB/sysfs: fix NULL dereference Leon Romanovsky
@ 2016-06-07 11:48 ` Doug Ledford
2 siblings, 0 replies; 7+ messages in thread
From: Doug Ledford @ 2016-06-07 11:48 UTC (permalink / raw)
To: Sudip Mukherjee, Sean Hefty, Hal Rosenstock; +Cc: linux-kernel, linux-rdma
[-- Attachment #1.1: Type: text/plain, Size: 1122 bytes --]
On 6/5/2016 4:13 PM, Sudip Mukherjee wrote:
> If stats->names is NULL or stats->num_counters <= 0 we are jumping to
> the error path where the for loop is freeing hsag->attrs[i]. But as i
> is initialized to 0 so i >= 0 will be true and the loop will execute
> once trying to free hsag->attrs[0]. But hsag is NULL still now leading
> to a NULL pointer dereference.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> ---
> drivers/infiniband/core/sysfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index 5e573bb..fcf6f9c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -891,7 +891,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
> {
> struct attribute_group *hsag = NULL;
> struct rdma_hw_stats *stats;
> - int i = 0, ret;
> + int i = -1, ret;
>
> stats = device->alloc_hw_stats(device, port_num);
>
>
This issue was fixed in a different way and this patch is no longer
applicable.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 884 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 2/2] IB/sysfs: fix memory leak
2016-06-05 20:13 ` [PATCH 2/2] IB/sysfs: fix memory leak Sudip Mukherjee
2016-06-06 6:34 ` Leon Romanovsky
@ 2016-06-07 11:50 ` Doug Ledford
1 sibling, 0 replies; 7+ messages in thread
From: Doug Ledford @ 2016-06-07 11:50 UTC (permalink / raw)
To: Sudip Mukherjee, Sean Hefty, Hal Rosenstock; +Cc: linux-kernel, linux-rdma
[-- Attachment #1.1: Type: text/plain, Size: 917 bytes --]
On 6/5/2016 4:13 PM, Sudip Mukherjee wrote:
> If the allocation of hsag fails we were just returning but stats was
> not released.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> ---
> drivers/infiniband/core/sysfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index fcf6f9c..8d8732c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
> sizeof(void *) * (stats->num_counters + 1),
> GFP_KERNEL);
> if (!hsag)
> - return;
> + goto err;
>
> ret = device->get_hw_stats(device, stats, port_num,
> stats->num_counters);
>
This issue was previously fixed by another patch and is no longer
applicable.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 884 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2016-06-07 11:50 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-05 20:13 [PATCH 1/2] IB/sysfs: fix NULL dereference Sudip Mukherjee
2016-06-05 20:13 ` [PATCH 2/2] IB/sysfs: fix memory leak Sudip Mukherjee
2016-06-06 6:34 ` Leon Romanovsky
2016-06-06 12:17 ` Leon Romanovsky
2016-06-07 11:50 ` Doug Ledford
2016-06-06 6:30 ` [PATCH 1/2] IB/sysfs: fix NULL dereference Leon Romanovsky
2016-06-07 11:48 ` Doug Ledford
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).