projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 1143c684 SL |
1 | From ea539ce1e1373c013ccedfb6cddc97661b5b59fe Mon Sep 17 00:00:00 2001 |
| 2 | From: Colin Ian King <colin.king@canonical.com> | |
| 3 | Date: Sat, 13 Apr 2019 17:00:26 +0100 | |
| 4 | Subject: RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure | |
| 5 | ||
| 6 | [ Upstream commit a6d2a5a92e67d151c98886babdc86d530d27111c ] | |
| 7 | ||
| 8 | Currently if alloc_skb fails to allocate the skb a null skb is passed to | |
| 9 | t4_set_arp_err_handler and this ends up dereferencing the null skb. Avoid | |
| 10 | the NULL pointer dereference by checking for a NULL skb and returning | |
| 11 | early. | |
| 12 | ||
| 13 | Addresses-Coverity: ("Dereference null return") | |
| 14 | Fixes: b38a0ad8ec11 ("RDMA/cxgb4: Set arp error handler for PASS_ACCEPT_RPL messages") | |
| 15 | Signed-off-by: Colin Ian King <colin.king@canonical.com> | |
| 16 | Acked-by: Potnuri Bharat Teja <bharat@chelsio.com> | |
| 17 | Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> | |
| 18 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
| 19 | --- | |
| 20 | drivers/infiniband/hw/cxgb4/cm.c | 2 ++ | |
| 21 | 1 file changed, 2 insertions(+) | |
| 22 | ||
| 23 | diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c | |
| 24 | index c9cffced00ca1..54fd4d81a3f1f 100644 | |
| 25 | --- a/drivers/infiniband/hw/cxgb4/cm.c | |
| 26 | +++ b/drivers/infiniband/hw/cxgb4/cm.c | |
| 27 | @@ -360,6 +360,8 @@ static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp) | |
| 28 | skb_reset_transport_header(skb); | |
| 29 | } else { | |
| 30 | skb = alloc_skb(len, gfp); | |
| 31 | + if (!skb) | |
| 32 | + return NULL; | |
| 33 | } | |
| 34 | t4_set_arp_err_handler(skb, NULL, NULL); | |
| 35 | return skb; | |
| 36 | -- | |
| 37 | 2.20.1 | |
| 38 |