[PATCH 1/2] IB/sysfs: fix NULL dereference

[PATCH 1/2] IB/sysfs: fix NULL dereference

[Sudip Mukherjee]

If stats->names is NULL or stats->num_counters <= 0 we are jumping to
the error path where the for loop is freeing hsag->attrs[i]. But as i
is initialized to 0 so i >= 0 will be true and the loop will execute
once trying to free hsag->attrs[0]. But hsag is NULL still now leading
to a NULL pointer dereference.

Signed-off-by: Sudip Mukherjee <sudip.mukherjee-4yDnlxn2s6sWdaTGBSpHTA@public.gmane.org>
---
 drivers/infiniband/core/sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 5e573bb..fcf6f9c 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -891,7 +891,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
 {
 	struct attribute_group *hsag = NULL;
 	struct rdma_hw_stats *stats;
-	int i = 0, ret;
+	int i = -1, ret;
 
 	stats = device->alloc_hw_stats(device, port_num);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 2/2] IB/sysfs: fix memory leak

[Sudip Mukherjee]

If the allocation of hsag fails we were just returning but stats was
not released.

Signed-off-by: Sudip Mukherjee <sudip.mukherjee-4yDnlxn2s6sWdaTGBSpHTA@public.gmane.org>
---
 drivers/infiniband/core/sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index fcf6f9c..8d8732c 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
 		       sizeof(void *) * (stats->num_counters + 1),
 		       GFP_KERNEL);
 	if (!hsag)
-		return;
+		goto err;
 
 	ret = device->get_hw_stats(device, stats, port_num,
 				   stats->num_counters);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 2/2] IB/sysfs: fix memory leak

[Leon Romanovsky]

[-- Attachment #1: Type: text/plain, Size: 1216 bytes --]

On Sun, Jun 05, 2016 at 09:13:56PM +0100, Sudip Mukherjee wrote:
> If the allocation of hsag fails we were just returning but stats was
> not released.
> 
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee-4yDnlxn2s6sWdaTGBSpHTA@public.gmane.org>

Thanks,
Reviewed-by: Leon Romanovsky <leonro-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>

> ---
>  drivers/infiniband/core/sysfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index fcf6f9c..8d8732c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
>  		       sizeof(void *) * (stats->num_counters + 1),
>  		       GFP_KERNEL);
>  	if (!hsag)
> -		return;
> +		goto err;
>  
>  	ret = device->get_hw_stats(device, stats, port_num,
>  				   stats->num_counters);
> -- 
> 1.9.1
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH 2/2] IB/sysfs: fix memory leak

[Leon Romanovsky]

[-- Attachment #1: Type: text/plain, Size: 1400 bytes --]

On Mon, Jun 06, 2016 at 09:34:54AM +0300, Leon Romanovsky wrote:
> On Sun, Jun 05, 2016 at 09:13:56PM +0100, Sudip Mukherjee wrote:
> > If the allocation of hsag fails we were just returning but stats was
> > not released.
> > 
> > Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> 
> Thanks,
> Reviewed-by: Leon Romanovsky <leonro@mellanox.com>

It looks the same as Colin's patch which was sent a week ago.
http://marc.info/?l=linux-kernel&m=146480441931189&w=2

> 
> > ---
> >  drivers/infiniband/core/sysfs.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> > index fcf6f9c..8d8732c 100644
> > --- a/drivers/infiniband/core/sysfs.c
> > +++ b/drivers/infiniband/core/sysfs.c
> > @@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
> >  		       sizeof(void *) * (stats->num_counters + 1),
> >  		       GFP_KERNEL);
> >  	if (!hsag)
> > -		return;
> > +		goto err;
> >  
> >  	ret = device->get_hw_stats(device, stats, port_num,
> >  				   stats->num_counters);
> > -- 
> > 1.9.1
> > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html



[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH 2/2] IB/sysfs: fix memory leak

[Doug Ledford]

[-- Attachment #1.1: Type: text/plain, Size: 917 bytes --]

On 6/5/2016 4:13 PM, Sudip Mukherjee wrote:
> If the allocation of hsag fails we were just returning but stats was
> not released.
> 
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> ---
>  drivers/infiniband/core/sysfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index fcf6f9c..8d8732c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -906,7 +906,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
>  		       sizeof(void *) * (stats->num_counters + 1),
>  		       GFP_KERNEL);
>  	if (!hsag)
> -		return;
> +		goto err;
>  
>  	ret = device->get_hw_stats(device, stats, port_num,
>  				   stats->num_counters);
> 

This issue was previously fixed by another patch and is no longer
applicable.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 884 bytes --]

Re: [PATCH 1/2] IB/sysfs: fix NULL dereference

[Leon Romanovsky]

[-- Attachment #1: Type: text/plain, Size: 1419 bytes --]

On Sun, Jun 05, 2016 at 09:13:55PM +0100, Sudip Mukherjee wrote:
> If stats->names is NULL or stats->num_counters <= 0 we are jumping to
> the error path where the for loop is freeing hsag->attrs[i]. But as i
> is initialized to 0 so i >= 0 will be true and the loop will execute
> once trying to free hsag->attrs[0]. But hsag is NULL still now leading
> to a NULL pointer dereference.
> 
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee-4yDnlxn2s6sWdaTGBSpHTA@public.gmane.org>

Thanks,
Reviewed-by: Leon Romanovsky <leonro-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>

> ---
>  drivers/infiniband/core/sysfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index 5e573bb..fcf6f9c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -891,7 +891,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
>  {
>  	struct attribute_group *hsag = NULL;
>  	struct rdma_hw_stats *stats;
> -	int i = 0, ret;
> +	int i = -1, ret;
>  
>  	stats = device->alloc_hw_stats(device, port_num);
>  
> -- 
> 1.9.1
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH 1/2] IB/sysfs: fix NULL dereference

[Doug Ledford]

[-- Attachment #1.1: Type: text/plain, Size: 1122 bytes --]

On 6/5/2016 4:13 PM, Sudip Mukherjee wrote:
> If stats->names is NULL or stats->num_counters <= 0 we are jumping to
> the error path where the for loop is freeing hsag->attrs[i]. But as i
> is initialized to 0 so i >= 0 will be true and the loop will execute
> once trying to free hsag->attrs[0]. But hsag is NULL still now leading
> to a NULL pointer dereference.
> 
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> ---
>  drivers/infiniband/core/sysfs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
> index 5e573bb..fcf6f9c 100644
> --- a/drivers/infiniband/core/sysfs.c
> +++ b/drivers/infiniband/core/sysfs.c
> @@ -891,7 +891,7 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
>  {
>  	struct attribute_group *hsag = NULL;
>  	struct rdma_hw_stats *stats;
> -	int i = 0, ret;
> +	int i = -1, ret;
>  
>  	stats = device->alloc_hw_stats(device, port_num);
>  
> 

This issue was fixed in a different way and this patch is no longer
applicable.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 884 bytes --]