diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2019-05-30 11:20:24 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-01-27 14:50:52 +0100 |
| commit | ccd93cb455305a6a643d4c541763c22edd45365d (patch) | |
| tree | 36134266b0242734c4d1d7790438d6032953ef53 /drivers/infiniband/core | |
| parent | 6c350e974c953d9a806c73b629eb46f40504743f (diff) | |
| download | linux-ccd93cb455305a6a643d4c541763c22edd45365d.tar.gz linux-ccd93cb455305a6a643d4c541763c22edd45365d.tar.bz2 linux-ccd93cb455305a6a643d4c541763c22edd45365d.zip | |
RDMA/uverbs: check for allocation failure in uapi_add_elm()
[ Upstream commit cac2a301c02a9b178842e22df34217da7854e588 ]
If the kzalloc() fails then we should return ERR_PTR(-ENOMEM). In the
current code it's possible that the kzalloc() fails and the
radix_tree_insert() inserts the NULL pointer successfully and we return
the NULL "elm" pointer to the caller. That results in a NULL pointer
dereference.
Fixes: 9ed3e5f44772 ("IB/uverbs: Build the specs into a radix tree at runtime")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/infiniband/core')
| -rw-r--r-- | drivers/infiniband/core/uverbs_uapi.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c index be854628a7c6..959a3418a192 100644 --- a/drivers/infiniband/core/uverbs_uapi.c +++ b/drivers/infiniband/core/uverbs_uapi.c @@ -17,6 +17,8 @@ static void *uapi_add_elm(struct uverbs_api *uapi, u32 key, size_t alloc_size) return ERR_PTR(-EOVERFLOW); elm = kzalloc(alloc_size, GFP_KERNEL); + if (!elm) + return ERR_PTR(-ENOMEM); rc = radix_tree_insert(&uapi->radix, key, elm); if (rc) { kfree(elm); |