Commit 46d0703f authored by Pan Bian's avatar Pan Bian Committed by Doug Ledford

IB/mlx4: fix improper return value

If uhw->inlen is non-zero, the value of variable err is 0 if the copy
succeeds. Then, if kzalloc() or kmalloc() returns a NULL pointer, it
will return 0 to the callers. As a result, the callers cannot detect the
errors. This patch fixes the bug, assign "-ENOMEM" to err before the
NULL pointer checks, and remove the initialization of err at the
beginning.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189031Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 5b4c9cd7
...@@ -430,7 +430,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev, ...@@ -430,7 +430,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
struct mlx4_ib_dev *dev = to_mdev(ibdev); struct mlx4_ib_dev *dev = to_mdev(ibdev);
struct ib_smp *in_mad = NULL; struct ib_smp *in_mad = NULL;
struct ib_smp *out_mad = NULL; struct ib_smp *out_mad = NULL;
int err = -ENOMEM; int err;
int have_ib_ports; int have_ib_ports;
struct mlx4_uverbs_ex_query_device cmd; struct mlx4_uverbs_ex_query_device cmd;
struct mlx4_uverbs_ex_query_device_resp resp = {.comp_mask = 0}; struct mlx4_uverbs_ex_query_device_resp resp = {.comp_mask = 0};
...@@ -455,6 +455,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev, ...@@ -455,6 +455,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
sizeof(resp.response_length); sizeof(resp.response_length);
in_mad = kzalloc(sizeof *in_mad, GFP_KERNEL); in_mad = kzalloc(sizeof *in_mad, GFP_KERNEL);
out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL); out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
err = -ENOMEM;
if (!in_mad || !out_mad) if (!in_mad || !out_mad)
goto out; goto out;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment