Commit 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
converted alloc_gid_table() to use kzalloc_flex(), which allocates
the ib_gid_table struct and its trailing data_vec flex array member
in a single contiguous slab block.
However, release_gid_table() was not updated accordingly and still
calls kfree(table->data_vec), passing a pointer that points 216 bytes
into the middle of the slab object rather than its head. This is an
invalid free which KASAN catches as:
BUG: KASAN: invalid-free in release_gid_table+0x384/0x470
Since data_vec is now a flex array member of ib_gid_table, it is
freed implicitly when kfree(table) is called. Remove the redundant
and invalid kfree(table->data_vec).
Fixes: 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
Reported-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4334f9a250019c1b79b4
Tested-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/infiniband/core/cache.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 896486fa6185..647a547e2d7f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -801,7 +801,6 @@ static void release_gid_table(struct ib_device *device,
}
mutex_destroy(&table->lock);
- kfree(table->data_vec);
kfree(table);
}
--
2.43.0