From patchwork Mon Feb 23 23:32:05 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Engelmayer X-Patchwork-Id: 5868481 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id A228A9F36A for ; Mon, 23 Feb 2015 23:34:25 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id AE0362063B for ; Mon, 23 Feb 2015 23:34:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7E0A920635 for ; Mon, 23 Feb 2015 23:34:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751925AbbBWXeW (ORCPT ); Mon, 23 Feb 2015 18:34:22 -0500 Received: from mout.gmx.net ([212.227.17.22]:53899 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751832AbbBWXeW (ORCPT ); Mon, 23 Feb 2015 18:34:22 -0500 Received: from localhost.localdomain ([81.217.123.197]) by mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0Mb8HX-1Y5Tkq2f75-00Kjn7; Tue, 24 Feb 2015 00:34:07 +0100 From: Christian Engelmayer To: mitesh.ahuja@emulex.com Cc: roland@kernel.org, sean.hefty@intel.com, hal.rosenstock@gmail.com, selvin.xavier@emulex.com, devesh.sharma@emulex.com, linux@rasmusvillemoes.dk, yishaih@mellanox.com, linux-rdma@vger.kernel.org, Christian Engelmayer Subject: [PATCH] RDMA/ocrdma: Fix double free in ocrdma_alloc_pd() Date: Tue, 24 Feb 2015 00:32:05 +0100 Message-Id: <1424734325-24310-1-git-send-email-cengelma@gmx.at> X-Mailer: git-send-email 1.9.1 X-Provags-ID: V03:K0:BjHEnV2wnotpXL79iAcf7AzLZod9Sfm3A6jztAutvQ3vuv0k9+q qH4ZqXnuBUbFfsQh2wWuNk/Jjk+bJefTs9jIiTFXmGzw/c5txrDv3ba3Nz0tvDaH5qCutBt zOzYAIKaip4Ht6ZhDuVkfFrE+LX9lbmO2LxjbbZEWb05z2no1JmLetbt6dF0j6a7Y091NGP fc4eyf60T1/TNx/uDdglw== X-UI-Out-Filterresults: notjunk:1; Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM, RCVD_IN_DNSWL_HI,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit 9ba1377daa51 ("RDMA/ocrdma: Move PD resource management to driver.") modified the err exit path in function ocrdma_alloc_pd() so that a call of _ocrdma_dealloc_pd(dev, pd) is followed by kfree(pd). However, _ocrdma_dealloc_pd() already unconditionally frees argument pd. Thus remove the double free. Detected by Coverity CID 1271296. Signed-off-by: Christian Engelmayer --- Compile tested only. Applies against linux-next. --- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c index 877175563634..74219d288aea 100644 --- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c @@ -675,12 +675,10 @@ pd_mapping: return &pd->ibpd; err: - if (is_uctx_pd) { + if (is_uctx_pd) ocrdma_release_ucontext_pd(uctx); - } else { + else status = _ocrdma_dealloc_pd(dev, pd); - kfree(pd); - } exit: return ERR_PTR(status); }