summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorWenwen Wang <wenwen@cs.uga.edu>2019-08-18 13:54:46 -0500
committerDoug Ledford <dledford@redhat.com>2019-08-20 13:44:45 -0400
commit2323d7baab2b18d87d9bc267452e387aa9f0060a (patch)
tree0b9297714a43ed975cbd4062ccbe5bfcb273a4ef /drivers
parentb08afa064c320e5d85cdc27228426b696c4c8dae (diff)
downloadlinux-stable-2323d7baab2b18d87d9bc267452e387aa9f0060a.tar.gz
linux-stable-2323d7baab2b18d87d9bc267452e387aa9f0060a.tar.bz2
linux-stable-2323d7baab2b18d87d9bc267452e387aa9f0060a.zip
infiniband: hfi1: fix memory leaks
In fault_opcodes_write(), 'data' is allocated through kcalloc(). However, it is not deallocated in the following execution if an error occurs, leading to memory leaks. To fix this issue, introduce the 'free_data' label to free 'data' before returning the error. Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Reviewed-by: Leon Romanovsky <leonro@mellanox.com> Acked-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Link: https://lore.kernel.org/r/1566154486-3713-1-git-send-email-wenwen@cs.uga.edu Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/infiniband/hw/hfi1/fault.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/hfi1/fault.c b/drivers/infiniband/hw/hfi1/fault.c
index 814324d17295..986c12153e62 100644
--- a/drivers/infiniband/hw/hfi1/fault.c
+++ b/drivers/infiniband/hw/hfi1/fault.c
@@ -141,12 +141,14 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
if (!data)
return -ENOMEM;
copy = min(len, datalen - 1);
- if (copy_from_user(data, buf, copy))
- return -EFAULT;
+ if (copy_from_user(data, buf, copy)) {
+ ret = -EFAULT;
+ goto free_data;
+ }
ret = debugfs_file_get(file->f_path.dentry);
if (unlikely(ret))
- return ret;
+ goto free_data;
ptr = data;
token = ptr;
for (ptr = data; *ptr; ptr = end + 1, token = ptr) {
@@ -195,6 +197,7 @@ static ssize_t fault_opcodes_write(struct file *file, const char __user *buf,
ret = len;
debugfs_file_put(file->f_path.dentry);
+free_data:
kfree(data);
return ret;
}