linux-kernel - [PATCH V2 for-next 10/19] IB/hns: Fix bug of memory leakage for registering user mr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 20 Sep 2016 17:07:03 +0100
From:   Salil Mehta <salil.mehta@...wei.com>
To:     <dledford@...hat.com>
CC:     <salil.mehta@...wei.com>, <xavier.huwei@...wei.com>,
        <oulijun@...wei.com>, <yisen.zhuang@...wei.com>,
        <mehta.salil.lnk@...il.com>, <xuwei5@...ilicon.com>,
        <linux-rdma@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linuxarm@...wei.com>, Dongdong Huang <hdd.huang@...wei.com>
Subject: [PATCH V2 for-next 10/19] IB/hns: Fix bug of memory leakage for registering user mr

From: Lijun Ou <oulijun@...wei.com>

While the page size attribute of umem is illegal, we should release
umem that get by ib_umem_get interface.

Also, we should return a non-zero value while pbl number is wrong.

Signed-off-by: Lijun Ou <oulijun@...wei.com>
Signed-off-by: Dongdong Huang(Donald) <hdd.huang@...wei.com>
Reviewed-by:  Wei Hu (Xavier) <xavier.huwei@...wei.com>
Signed-off-by: Salil Mehta <salil.mehta@...wei.com>
---
 drivers/infiniband/hw/hns/hns_roce_mr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index 59f5e2b..fb87883 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -564,11 +564,14 @@ struct ib_mr *hns_roce_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	if (mr->umem->page_size != HNS_ROCE_HEM_PAGE_SIZE) {
 		dev_err(dev, "Just support 4K page size but is 0x%x now!\n",
 			mr->umem->page_size);
+		ret = -EINVAL;
+		goto err_umem;
 	}
 
 	if (n > HNS_ROCE_MAX_MTPT_PBL_NUM) {
 		dev_err(dev, " MR len %lld err. MR is limited to 4G at most!\n",
 			length);
+		ret = -EINVAL;
 		goto err_umem;
 	}
 
-- 
1.9.1