diff options
| author | Alex Estrin <alex.estrin@intel.com> | 2018-02-01 10:43:58 -0800 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2018-02-01 15:24:32 -0700 |
| commit | 2b1e7fe16124e86ee9242aeeee859c79a843e3a2 (patch) | |
| tree | 233de075dfe127bfcdc5faec36f5aa69d221381d /drivers/infiniband/hw/hfi1/file_ops.c | |
| parent | 473291b3ea0e1df81f7abf13b8ab4b98a346df5e (diff) | |
IB/hfi1: Fix for potential refcount leak in hfi1_open_file()
The dd refcount is speculatively incremented prior to allocating
the fd memory with kzalloc(). If that kzalloc() failed the dd
refcount leaks.
Increment refcount on kzalloc success.
Fixes: e11ffbd57520 ("IB/hfi1: Do not free hfi1 cdev parent structure early")
Reviewed-by: Michael J Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Alex Estrin <alex.estrin@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/hw/hfi1/file_ops.c')
| -rw-r--r-- | drivers/infiniband/hw/hfi1/file_ops.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index 1df7da47f431..acf0ba56c309 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -196,9 +196,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) if (!atomic_inc_not_zero(&dd->user_refcount)) return -ENXIO; - /* Just take a ref now. Not all opens result in a context assign */ - kobject_get(&dd->kobj); - /* The real work is performed later in assign_ctxt() */ fd = kzalloc(sizeof(*fd), GFP_KERNEL); @@ -208,6 +205,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) fd->mm = current->mm; mmgrab(fd->mm); fd->dd = dd; + kobject_get(&fd->dd->kobj); fp->private_data = fd; } else { fp->private_data = NULL; |