IB/hfi1: Fix for potential refcount leak in hfi1_open_file()
authorAlex Estrin <alex.estrin@intel.com>
Thu, 1 Feb 2018 18:43:58 +0000 (10:43 -0800)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 1 Feb 2018 22:24:32 +0000 (15:24 -0700)
The dd refcount is speculatively incremented prior to allocating
the fd memory with kzalloc(). If that kzalloc() failed the dd
refcount leaks.
Increment refcount on kzalloc success.

Fixes: e11ffbd57520 ("IB/hfi1: Do not free hfi1 cdev parent structure early")
Reviewed-by: Michael J Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Alex Estrin <alex.estrin@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/hw/hfi1/file_ops.c

index 1df7da4..acf0ba5 100644 (file)
@@ -196,9 +196,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
        if (!atomic_inc_not_zero(&dd->user_refcount))
                return -ENXIO;
 
-       /* Just take a ref now. Not all opens result in a context assign */
-       kobject_get(&dd->kobj);
-
        /* The real work is performed later in assign_ctxt() */
 
        fd = kzalloc(sizeof(*fd), GFP_KERNEL);
@@ -208,6 +205,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
                fd->mm = current->mm;
                mmgrab(fd->mm);
                fd->dd = dd;
+               kobject_get(&fd->dd->kobj);
                fp->private_data = fd;
        } else {
                fp->private_data = NULL;