Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Tomer Tayar <ttayar@habana.ai>
To:     "oded.gabbay@gmail.com" <oded.gabbay@gmail.com>
CC:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: [PATCH] habanalabs: Avoid double free in error flow
Thread-Topic: [PATCH] habanalabs: Avoid double free in error flow
Thread-Index: AQHVSHESnMF5xI6k90aQZDGOYR1fbw==
Date:   Thu, 1 Aug 2019 13:57:36 +0000
Message-ID: <20190801135721.13211-1-ttayar@habana.ai>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.17.1
x-originating-ip: [31.154.190.6]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: e4316656-4aa8-40ac-486e-08d716883527
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020);SRVR:VI1PR02MB5296;
x-ms-traffictypediagnostic: VI1PR02MB5296:
x-microsoft-antispam-prvs: <VI1PR02MB529677C2D246ED8F84DC350AD2DE0@VI1PR02MB5296.eurprd02.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:3173;
x-forefront-prvs: 01165471DB
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(396003)(376002)(346002)(366004)(136003)(39840400004)(199004)(189003)(66446008)(66066001)(86362001)(14444005)(256004)(6486002)(66946007)(66476007)(66556008)(64756008)(186003)(305945005)(476003)(6916009)(6436002)(50226002)(6506007)(486006)(2351001)(386003)(2906002)(81166006)(81156014)(2616005)(7736002)(6116002)(3846002)(4326008)(478600001)(25786009)(8676002)(8936002)(68736007)(316002)(1361003)(6512007)(26005)(5660300002)(102836004)(53936002)(36756003)(52116002)(2501003)(1076003)(71200400001)(99286004)(5640700003)(14454004)(71190400001);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR02MB5296;H:VI1PR02MB3054.eurprd02.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: habana.ai does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: VNaPGcxSnR1G7q0LPUAQiXqMuQm6kLvZxjGCAhXGSRHU25kghOHveB24kO/uJLussFdQtGj5dwCmW9/bEXvlfkTHfVe+VugiTwy2Kcobkn65/oiNx9WGWAg2Of1czhIihSPQvsh00Xcw076WEIBxJykRwZSjGvwvbLiB5sZXmIf1wMLfB/ITlv7L5LSrSUgzAdMPk9XK5mtB4PBXILVYg5HJ57EkxCVw3EjnRL00NaAXj9/H/HjmVn2GaTdCZZc7XKSgmpomopDZjlRly5+rF324m6Q38ykX2ontV5+8WcERw6ZCZemC9nRDJe2yvR5Mf2GmuRnqkzUcI/ZTJozEYV/NylAMguNZrLe+sjD5TReYAkbqaqJtOFd+Ix1VBDyOc+YWcUkLWAskIM/KxMmorQ7Z4ACOZSk9iiWNZXwlyP8=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: habana.ai
X-MS-Exchange-CrossTenant-Network-Message-Id: e4316656-4aa8-40ac-486e-08d716883527
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Aug 2019 13:57:36.1723
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 0d4d4539-213c-4ed8-a251-dc9766ba127a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: ttayar@habana.ai
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR02MB5296
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

In case kernel context init fails during device initialization, both
hl_ctx_put() and kfree() are called, ending with a double free of the
kernel context.
Calling kfree() is needed only when a failure happens between the
allocation of the kernel context and its initialization, so move it to
there and remove it from the error flow.

Signed-off-by: Tomer Tayar <ttayar@habana.ai>
---
 drivers/misc/habanalabs/device.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/dev=
ice.c
index 0c4894dd9c02..7a8f9d0b71b5 100644
--- a/drivers/misc/habanalabs/device.c
+++ b/drivers/misc/habanalabs/device.c
@@ -970,7 +970,8 @@ int hl_device_init(struct hl_device *hdev, struct class=
 *hclass)
 	rc =3D hl_ctx_init(hdev, hdev->kernel_ctx, true);
 	if (rc) {
 		dev_err(hdev->dev, "failed to initialize kernel context\n");
-		goto free_ctx;
+		kfree(hdev->kernel_ctx);
+		goto mmu_fini;
 	}
=20
 	rc =3D hl_cb_pool_init(hdev);
@@ -1053,8 +1054,6 @@ int hl_device_init(struct hl_device *hdev, struct cla=
ss *hclass)
 	if (hl_ctx_put(hdev->kernel_ctx) !=3D 1)
 		dev_err(hdev->dev,
 			"kernel ctx is still alive on initialization failure\n");
-free_ctx:
-	kfree(hdev->kernel_ctx);
 mmu_fini:
 	hl_mmu_fini(hdev);
 eq_fini:
--=20
2.17.1