kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

IB/hfi1: Fix for potential refcount leak in hfi1_open_file()

Browse source 
The dd refcount is speculatively incremented prior to allocating
the fd memory with kzalloc(). If that kzalloc() failed the dd
refcount leaks.
Increment refcount on kzalloc success.

Fixes: e11ffbd575 ("IB/hfi1: Do not free hfi1 cdev parent structure early")
Reviewed-by: Michael J Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Alex Estrin <alex.estrin@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Alex Estrin 2018-02-01 10:43:58 -08:00 committed by Jason Gunthorpe
parent 473291b3ea
commit 2b1e7fe161
1 changed files with 1 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/infiniband/hw/hfi1/file_ops.c
View file

@ -196,9 +196,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
if (!atomic_inc_not_zero(&dd->user_refcount))
return -ENXIO;
/* Just take a ref now. Not all opens result in a context assign */
kobject_get(&dd->kobj);
/* The real work is performed later in assign_ctxt() */
fd = kzalloc(sizeof(*fd), GFP_KERNEL);
@ -208,6 +205,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
fd->mm = current->mm;
mmgrab(fd->mm);
fd->dd = dd;
kobject_get(&fd->dd->kobj);
fp->private_data = fd;
} else {
fp->private_data = NULL;