lkml.org 
[lkml]   [2019]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 110/193] RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
    Date
    [ Upstream commit a6d2a5a92e67d151c98886babdc86d530d27111c ]

    Currently if alloc_skb fails to allocate the skb a null skb is passed to
    t4_set_arp_err_handler and this ends up dereferencing the null skb. Avoid
    the NULL pointer dereference by checking for a NULL skb and returning
    early.

    Addresses-Coverity: ("Dereference null return")
    Fixes: b38a0ad8ec11 ("RDMA/cxgb4: Set arp error handler for PASS_ACCEPT_RPL messages")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Acked-by: Potnuri Bharat Teja <bharat@chelsio.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/infiniband/hw/cxgb4/cm.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
    index e17f11782821b..d87f08cd78ad4 100644
    --- a/drivers/infiniband/hw/cxgb4/cm.c
    +++ b/drivers/infiniband/hw/cxgb4/cm.c
    @@ -456,6 +456,8 @@ static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp)
    skb_reset_transport_header(skb);
    } else {
    skb = alloc_skb(len, gfp);
    + if (!skb)
    + return NULL;
    }
    t4_set_arp_err_handler(skb, NULL, NULL);
    return skb;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-05-30 05:35    [W:4.058 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site