From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Alex Estrin , Jason Gunthorpe , Sasha Levin Subject: [PATCH AUTOSEL for 4.14 109/161] IB/hfi1: Fix for potential refcount leak in hfi1_open_file() Date: Mon, 9 Apr 2018 00:21:21 +0000 Message-ID: <20180409001936.162706-109-alexander.levin@microsoft.com> References: <20180409001936.162706-1-alexander.levin@microsoft.com> In-Reply-To: <20180409001936.162706-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Alex Estrin [ Upstream commit 2b1e7fe16124e86ee9242aeeee859c79a843e3a2 ] The dd refcount is speculatively incremented prior to allocating the fd memory with kzalloc(). If that kzalloc() failed the dd refcount leaks. Increment refcount on kzalloc success. Fixes: e11ffbd57520 ("IB/hfi1: Do not free hfi1 cdev parent structure early= ") Reviewed-by: Michael J Ruhl Signed-off-by: Alex Estrin Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin --- drivers/infiniband/hw/hfi1/file_ops.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/= hfi1/file_ops.c index fd28f09b4445..ee2253d06984 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -191,9 +191,6 @@ static int hfi1_file_open(struct inode *inode, struct f= ile *fp) if (!atomic_inc_not_zero(&dd->user_refcount)) return -ENXIO; =20 - /* Just take a ref now. Not all opens result in a context assign */ - kobject_get(&dd->kobj); - /* The real work is performed later in assign_ctxt() */ =20 fd =3D kzalloc(sizeof(*fd), GFP_KERNEL); @@ -203,6 +200,7 @@ static int hfi1_file_open(struct inode *inode, struct f= ile *fp) fd->mm =3D current->mm; mmgrab(fd->mm); fd->dd =3D dd; + kobject_get(&fd->dd->kobj); fp->private_data =3D fd; } else { fp->private_data =3D NULL; --=20 2.15.1