Commit a7bfb93f authored Aug 19, 2019 by zhengbin Committed by Doug Ledford Aug 20, 2019

RDMA/cma: fix null-ptr-deref Read in cma_cleanup



In cma_init, if cma_configfs_init fails, need to free the
previously memory and return fail, otherwise will trigger
null-ptr-deref Read in cma_cleanup.

cma_cleanup
  cma_configfs_exit
    configfs_unregister_subsystem

Fixes: 045959db ("IB/cma: Add configfs for rdma_cm")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: zhengbin <zhengbin13@huawei.com>
Reviewed-by: Parav Pandit <parav@mellanox.com>
Link: https://lore.kernel.org/r/1566188859-103051-1-git-send-email-zhengbin13@huawei.com


Signed-off-by: Doug Ledford <dledford@redhat.com>

parent 841b07f9

drivers/infiniband/core/cma.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -4724,10 +4724,14 @@ static int __init cma_init(void)
		if (ret)
		goto err;

		cma_configfs_init();
		ret = cma_configfs_init();
		if (ret)
		goto err_ib;

		return 0;

		err_ib:
		ib_unregister_client(&cma_client);
		err:
		unregister_netdevice_notifier(&cma_nb);
		ib_sa_unregister_client(&sa_client);

Admin message