linux-kernel - [PATCH] IB/core: fix null pointer dereference and memory leak in error handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed,  1 Jun 2016 19:06:36 +0100
From:	Colin King <colin.king@...onical.com>
To:	Doug Ledford <dledford@...hat.com>,
	Sean Hefty <sean.hefty@...el.com>,
	Hal Rosenstock <hal.rosenstock@...il.com>,
	Ira Weiny <ira.weiny@...el.com>,
	Christoph Lameter <cl@...ux.com>,
	Matan Barak <matanb@...lanox.com>,
	Jason Gunthorpe <jgunthorpe@...idianresearch.com>,
	linux-rdma@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org
Subject: [PATCH] IB/core: fix null pointer dereference and memory leak in error handling

From: Colin Ian King <colin.king@...onical.com>

The current error handling in setup_hw_stats has a couple of issues.
It is possible to generate a null pointer deference on the
kfree of hsag->attrs[i] because two of the early error exit paths
jump to the kfree when hsags NULL and not allocated. Fix this by
moving the kfree on stats and jumping to that, avoiding the hsag
freeing.

Secondly, there is a memory leak of stats if the hsag allocation
fails; instead of returning, jump to the kfree on stats.

Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/infiniband/core/sysfs.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 5e573bb..ed04a7b 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -899,14 +899,14 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
 		return;
 
 	if (!stats->names || stats->num_counters <= 0)
-		goto err;
+		goto err_free_stats;
 
 	hsag = kzalloc(sizeof(*hsag) +
 		       // 1 extra for the lifespan config entry
 		       sizeof(void *) * (stats->num_counters + 1),
 		       GFP_KERNEL);
 	if (!hsag)
-		return;
+		goto err_free_stats;
 
 	ret = device->get_hw_stats(device, stats, port_num,
 				   stats->num_counters);
@@ -946,10 +946,11 @@ static void setup_hw_stats(struct ib_device *device, struct ib_port *port,
 	return;
 
 err:
-	kfree(stats);
 	for (; i >= 0; i--)
 		kfree(hsag->attrs[i]);
 	kfree(hsag);
+err_free_stats:
+	kfree(stats);
 	return;
 }
 
-- 
2.8.1