| Message ID | 20220124122135.5745-1-linmq006@gmail.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [v2] RDMA/rtrs: Fix double free in alloc_clt | expand |
On Mon, Jan 24, 2022 at 1:21 PM Miaoqian Lin <linmq006@gmail.com> wrote: > > Callback function rtrs_clt_dev_release() in put_device() > calls kfree(clt); to free memory. We shouldn't call kfree(clt) again. > > Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") > Signed-off-by: Miaoqian Lin <linmq006@gmail.com> Hi Miaoqian, this is the complete fix. https://lore.kernel.org/linux-rdma/Ye00cQ+VUkzh8JCH@unreal/T/#t Thanks! > --- > Changes in v2: > - call free_percpu() before put_device() to avoid UAF. > --- > drivers/infiniband/ulp/rtrs/rtrs-clt.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c > index 7c3f98e57889..aff04f566304 100644 > --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c > +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c > @@ -2739,10 +2739,8 @@ static struct rtrs_clt_sess *alloc_clt(const char *sessname, size_t paths_num, > */ > dev_set_uevent_suppress(&clt->dev, true); > err = device_register(&clt->dev); > - if (err) { > - put_device(&clt->dev); > - goto err; > - } > + if (err) > + goto err_register; > > clt->kobj_paths = kobject_create_and_add("paths", &clt->dev.kobj); > if (!clt->kobj_paths) { > @@ -2764,6 +2762,11 @@ static struct rtrs_clt_sess *alloc_clt(const char *sessname, size_t paths_num, > err: > free_percpu(clt->pcpu_path); > kfree(clt); > + goto ret; > +err_register: > + free_percpu(clt->pcpu_path); > + put_device(&clt->dev); > +ret: > return ERR_PTR(err); > } > > -- > 2.17.1 >
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c index 7c3f98e57889..aff04f566304 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c @@ -2739,10 +2739,8 @@ static struct rtrs_clt_sess *alloc_clt(const char *sessname, size_t paths_num, */ dev_set_uevent_suppress(&clt->dev, true); err = device_register(&clt->dev); - if (err) { - put_device(&clt->dev); - goto err; - } + if (err) + goto err_register; clt->kobj_paths = kobject_create_and_add("paths", &clt->dev.kobj); if (!clt->kobj_paths) { @@ -2764,6 +2762,11 @@ static struct rtrs_clt_sess *alloc_clt(const char *sessname, size_t paths_num, err: free_percpu(clt->pcpu_path); kfree(clt); + goto ret; +err_register: + free_percpu(clt->pcpu_path); + put_device(&clt->dev); +ret: return ERR_PTR(err); }
Callback function rtrs_clt_dev_release() in put_device() calls kfree(clt); to free memory. We shouldn't call kfree(clt) again. Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Signed-off-by: Miaoqian Lin <linmq006@gmail.com> --- Changes in v2: - call free_percpu() before put_device() to avoid UAF. --- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)