IB/mlx4: fix bug unwinding on error in mlx4_ib_init_sriov()

PATCH New Dan Carpenter 1 participant 1 message Feb 4, 2013

Subsystems (3)

Kernel janitors InfiniBand Mellanox MLX4 IB driver

lore

Share & tools

lore

Dan Carpenter

author

2013-02-04 11:22 UTC #0 lore raw

PATCH 1/1 IB/mlx4: fix bug unwinding on error in mlx4_ib_init_sriov()

We have to decrement "i" before calling mlx4_ib_free_demux_ctx() or we free something that wasn't allocated. That's fine for free_pv_object() but it would lead to a NULL dereference calling mlx4_ib_free_demux_ctx(). The null dereference is because ->tun is NULL when we check:

	if (!ctx->tun[i])

Also we didn't free ->sriov.demux[0] so it was a small leak.

Signed-off-by Dan Carpenter <[email protected]>

---
Static checker stuff. I have not tested this.

drivers/infiniband/hw/mlx4/mad.c +4 -3

index 0a903c1..934792c 100644
@@ -1999,16 +1999,17 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
 			goto demux_err;
 		err = mlx4_ib_alloc_demux_ctx(dev, &dev->sriov.demux[i], i + 1);
 		if (err)
-			goto demux_err;
+			goto free_pv;
 	}
 	mlx4_ib_master_tunnels(dev, 1);
 	return 0;
 
+free_pv:
+	free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1);
 demux_err:
-	while (i > 0) {
+	while (--i >= 0) {
 		free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1);
 		mlx4_ib_free_demux_ctx(&dev->sriov.demux[i]);
-		--i;
 	}
 	mlx4_ib_device_unregister_sysfs(dev);