]>
Commit | Line | Data |
---|---|---|
d50b8c78 SL |
1 | From b1c6e04feba786a164f1102c52dcb2d713c7d805 Mon Sep 17 00:00:00 2001 |
2 | From: Kangjie Lu <kjlu@umn.edu> | |
3 | Date: Tue, 14 May 2019 15:44:49 -0700 | |
4 | Subject: rapidio: fix a NULL pointer dereference when create_workqueue() fails | |
5 | ||
6 | [ Upstream commit 23015b22e47c5409620b1726a677d69e5cd032ba ] | |
7 | ||
8 | In case create_workqueue fails, the fix releases resources and returns | |
9 | -ENOMEM to avoid NULL pointer dereference. | |
10 | ||
11 | Signed-off-by: Kangjie Lu <kjlu@umn.edu> | |
12 | Acked-by: Alexandre Bounine <alex.bou9@gmail.com> | |
13 | Cc: Matt Porter <mporter@kernel.crashing.org> | |
14 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | |
15 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | |
16 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
17 | --- | |
18 | drivers/rapidio/rio_cm.c | 8 ++++++++ | |
19 | 1 file changed, 8 insertions(+) | |
20 | ||
21 | diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c | |
22 | index cf45829585cb..b29fc258eeba 100644 | |
23 | --- a/drivers/rapidio/rio_cm.c | |
24 | +++ b/drivers/rapidio/rio_cm.c | |
25 | @@ -2147,6 +2147,14 @@ static int riocm_add_mport(struct device *dev, | |
26 | mutex_init(&cm->rx_lock); | |
27 | riocm_rx_fill(cm, RIOCM_RX_RING_SIZE); | |
28 | cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); | |
29 | + if (!cm->rx_wq) { | |
30 | + riocm_error("failed to allocate IBMBOX_%d on %s", | |
31 | + cmbox, mport->name); | |
32 | + rio_release_outb_mbox(mport, cmbox); | |
33 | + kfree(cm); | |
34 | + return -ENOMEM; | |
35 | + } | |
36 | + | |
37 | INIT_WORK(&cm->rx_work, rio_ibmsg_handler); | |
38 | ||
39 | cm->tx_slot = 0; | |
40 | -- | |
41 | 2.20.1 | |
42 |