diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2013-02-04 11:22:36 +0000 |
|---|---|---|
| committer |   Roland Dreier <roland@purestorage.com> | 2013-02-15 15:22:26 -0800 |
| commit | cab66d1273e6490603cf5256155584d38cecca68 (patch) | |
| tree | 3c698a4645dd873c0f4ac025b4a4ccb005b3f1af /drivers | |
| parent | Linux 3.8-rc7 (diff) | |
| download | linux-dev-cab66d1273e6490603cf5256155584d38cecca68.tar.xz linux-dev-cab66d1273e6490603cf5256155584d38cecca68.zip | |
IB/mlx4: Fix bug unwinding on error in mlx4_ib_init_sriov()
We have to decrement "i" before calling mlx4_ib_free_demux_ctx() or we
free something that wasn't allocated. That's fine for free_pv_object()
but it would lead to a NULL dereference calling mlx4_ib_free_demux_ctx().
The null dereference is because ->tun is NULL when we check:
if (!ctx->tun[i])
Also we didn't free ->sriov.demux[0] so it was a small leak.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/hw/mlx4/mad.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c index 0a903c129f0a..934792c477bc 100644 --- a/drivers/infiniband/hw/mlx4/mad.c +++ b/drivers/infiniband/hw/mlx4/mad.c @@ -1999,16 +1999,17 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev) goto demux_err; err = mlx4_ib_alloc_demux_ctx(dev, &dev->sriov.demux[i], i + 1); if (err) - goto demux_err; + goto free_pv; } mlx4_ib_master_tunnels(dev, 1); return 0; +free_pv: + free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1); demux_err: - while (i > 0) { + while (--i >= 0) { free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1); mlx4_ib_free_demux_ctx(&dev->sriov.demux[i]); - --i; } mlx4_ib_device_unregister_sysfs(dev); |