linux-kernel - Re: [PATCH] lpfc: fix memory leak and NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <561BF5B5.4080901@avagotech.com>
Date:	Mon, 12 Oct 2015 11:02:29 -0700
From:	James Smart <james.smart@...gotech.com>
To:	Sudip Mukherjee <sudipm.mukherjee@...il.com>,
	Dick Kennedy <dick.kennedy@...gotech.com>,
	"James E.J. Bottomley" <JBottomley@...n.com>
Cc:	linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org
Subject: Re: [PATCH] lpfc: fix memory leak and NULL dereference

Looks Good - Thank you Sudip.

Reviewed-by: James Smart <james.smart@...gotech.com>

-- james s


On 9/23/2015 6:32 AM, Sudip Mukherjee wrote:
> kmalloc() can return NULL and without checking we were dereferencing it.
> Moreover if kmalloc succeeds but the function fails in other parts then
> we were returning the error code but we missed freeing lcb_context.
> While at it fixed one related checkpatch warning.
>
> Signed-off-by: Sudip Mukherjee <sudip@...torindia.org>
> ---
>
> I am not exactly sure if LSRJT_UNABLE_TPC is the right error code here.
> But that was my best guess.
>
>   drivers/scsi/lpfc/lpfc_els.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
> index 36bf58b..a27efd9 100644
> --- a/drivers/scsi/lpfc/lpfc_els.c
> +++ b/drivers/scsi/lpfc/lpfc_els.c
> @@ -5209,7 +5209,6 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
>   		rjt_err = LSRJT_CMD_UNSUPPORTED;
>   		goto rjt;
>   	}
> -	lcb_context = kmalloc(sizeof(struct lpfc_lcb_context), GFP_KERNEL);
>   
>   	if (phba->hba_flag & HBA_FCOE_MODE) {
>   		rjt_err = LSRJT_CMD_UNSUPPORTED;
> @@ -5240,6 +5239,12 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
>   		goto rjt;
>   	}
>   
> +	lcb_context = kmalloc(sizeof(*lcb_context), GFP_KERNEL);
> +	if (!lcb_context) {
> +		rjt_err = LSRJT_UNABLE_TPC;
> +		goto rjt;
> +	}
> +
>   	state = (beacon->lcb_sub_command == LPFC_LCB_ON) ? 1 : 0;
>   	lcb_context->sub_command = beacon->lcb_sub_command;
>   	lcb_context->type = beacon->lcb_type;
> @@ -5250,6 +5255,7 @@ lpfc_els_rcv_lcb(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
>   	if (lpfc_sli4_set_beacon(vport, lcb_context, state)) {
>   		lpfc_printf_vlog(ndlp->vport, KERN_ERR,
>   				 LOG_ELS, "0193 failed to send mail box");
> +		kfree(lcb_context);
>   		lpfc_nlp_put(ndlp);
>   		rjt_err = LSRJT_UNABLE_TPC;
>   		goto rjt;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/