IB/core: off by one in error handling
Subsystems (2)
PATCH 1/1 IB/core: off by one in error handling
This is a zero offset array. The current code could try to free random memory and crash. Also it leaks the first element.
drivers/infiniband/core/cache.c +1 -1
@@ -582,7 +582,7 @@ static int _gid_table_setup_one(struct ib_device *ib_dev)return 0 ; rollback_table_setup: -for (port =1 ; port <= ib_dev->phys_port_cnt; port++) +for (port =0 ; port < ib_dev->phys_port_cnt; port++)free_gid_table (ib_dev, port, table[port]);kfree (table);
Quoted 5 lines · Dan Carpenter
This is a zero offset array. The current code could try to free random memory and crash. Also it leaks the first element.
Fixes 230145ff8124 ('IB/core: Add RoCE GID table management')Signed-off-by Dan Carpenter <[email protected]>
I don't actually see this in Dougs to-be-rebased/for-4.3 tree.
Looks like Doug picked up a different version of the patch in the latest rebase.
annotating cache.c I see a different change from Matan in commit
76680c1cfc5ab
+rollback_table_setup:
+ for (port = 0; port < ib_dev->phys_port_cnt; port++) {
+ cleanup_gid_table_port(ib_dev, port + rdma_start_port(ib_dev),
+ table[port]);
+ release_gid_table(table[port]);
+ }
Ira
Quoted 14 lines
drivers/infiniband/core/cache.c +1
-1@@ -582,7 +582,7 @@ static int _gid_table_setup_one(struct ib_device *ib_dev)return 0 ; rollback_table_setup: -for (port =1 ; port <= ib_dev->phys_port_cnt; port++) +for (port =0 ; port < ib_dev->phys_port_cnt; port++)free_gid_table (ib_dev, port, table[port]);kfree (table);
Quoted 23 lines · ira.weiny
Quoted 5 lines · Dan Carpenter
This is a zero offset array. The current code could try to free random memory and crash. Also it leaks the first element.
Fixes 230145ff8124 ('IB/core: Add RoCE GID table management')Signed-off-by Dan Carpenter <[email protected]>I don't actually see this in Dougs to-be-rebased/for-4.3 tree.
Looks like Doug picked up a different version of the patch in the latest rebase.
annotating
cache.cI see a different change from Matan in commit
76680c1cfc5ab(quoted diff) +6
-0+rollback_table_setup: + for (port = 0; port < ib_dev->phys_port_cnt; port++) { + cleanup_gid_table_port(ib_dev, port + rdma_start_port(ib_dev), + table[port]); + release_gid_table(table[port]); + }
Quoted 1 line
Ira
Correct, so I dropped this patch.
Quoted 19 lines
Quoted 6 lines
drivers/infiniband/core/cache.c +0
-0drivers/infiniband/core/cache.c static int _gid_table_setup_one(struct ib_device *ib_dev) · line 588
Quoted 8 lines
drivers/infiniband/core/cache.c +1
-1@@ -582,7 +582,7 @@ static int _gid_table_setup_one(struct ib_device *ib_dev)return 0 ; rollback_table_setup: -for (port =1 ; port <= ib_dev->phys_port_cnt; port++) +for (port =0 ; port < ib_dev->phys_port_cnt; port++)free_gid_table (ib_dev, port, table[port]);kfree (table);--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Signature · 2 lines
Doug Ledford <[email protected]> GPG KeyID: 0E572FDD
Quoted 5 lines · Dan Carpenter
This is a zero offset array. The current code could try to free random memory and crash. Also it leaks the first element.
Fixes 230145ff8124 ('IB/core: Add RoCE GID table management')Signed-off-by Dan Carpenter <[email protected]>
This one, however, was not needed after Matan's fixup series was applied.
Quoted 14 lines
drivers/infiniband/core/cache.c +1
-1@@ -582,7 +582,7 @@ static int _gid_table_setup_one(struct ib_device *ib_dev)return 0 ; rollback_table_setup: -for (port =1 ; port <= ib_dev->phys_port_cnt; port++) +for (port =0 ; port < ib_dev->phys_port_cnt; port++)free_gid_table (ib_dev, port, table[port]);kfree (table);
Signature · 2 lines
Doug Ledford <[email protected]> GPG KeyID: 0E572FDD