queue-4.19/rapidio-fix-a-null-pointer-dereference-when-create_w.patch

   1 From f812d32c795606d8bb3db2d10f98b182ea08239f Mon Sep 17 00:00:00 2001
   2 From: Kangjie Lu <kjlu@umn.edu>
   3 Date: Tue, 14 May 2019 15:44:49 -0700
   4 Subject: rapidio: fix a NULL pointer dereference when create_workqueue() fails
   5
   6 [ Upstream commit 23015b22e47c5409620b1726a677d69e5cd032ba ]
   7
   8 In case create_workqueue fails, the fix releases resources and returns
   9 -ENOMEM to avoid NULL pointer dereference.
  10
  11 Signed-off-by: Kangjie Lu <kjlu@umn.edu>
  12 Acked-by: Alexandre Bounine <alex.bou9@gmail.com>
  13 Cc: Matt Porter <mporter@kernel.crashing.org>
  14 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  15 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  16 Signed-off-by: Sasha Levin <sashal@kernel.org>
  17 ---
  18  drivers/rapidio/rio_cm.c | 8 ++++++++
  19  1 file changed, 8 insertions(+)
  20
  21 diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
  22 index bad0e0ea4f30..ef989a15aefc 100644
  23 --- a/drivers/rapidio/rio_cm.c
  24 +++ b/drivers/rapidio/rio_cm.c
  25 @@ -2145,6 +2145,14 @@ static int riocm_add_mport(struct device *dev,
  26         mutex_init(&cm->rx_lock);
  27         riocm_rx_fill(cm, RIOCM_RX_RING_SIZE);
  28         cm->rx_wq = create_workqueue(DRV_NAME "/rxq");
  29 +       if (!cm->rx_wq) {
  30 +               riocm_error("failed to allocate IBMBOX_%d on %s",
  31 +                           cmbox, mport->name);
  32 +               rio_release_outb_mbox(mport, cmbox);
  33 +               kfree(cm);
  34 +               return -ENOMEM;
  35 +       }
  36 +
  37         INIT_WORK(&cm->rx_work, rio_ibmsg_handler);
  38
  39         cm->tx_slot = 0;
  40 --
  41 2.20.1
  42