On Wed, 14 Jun 2017, Yuval Shaia wrote:
> On Wed, Jun 14, 2017 at 01:39:24PM +0300, Dan Carpenter wrote:
> > We accidentally return ERR_PTR(0) if ib_alloc_mr() fails. The caller
> > is expecting error pointers so it results in a NULL dereference.
> >
> > Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
> > Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> >
> > diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
> > index 48332a6ed738..74a66cc162ed 100644
> > --- a/net/rds/ib_frmr.c
> > +++ b/net/rds/ib_frmr.c
> > @@ -38,7 +38,7 @@ static struct rds_ib_mr *rds_ib_alloc_frmr(struct rds_ib_device *rds_ibdev,
> > struct rds_ib_mr_pool *pool;
> > struct rds_ib_mr *ibmr = NULL;
> > struct rds_ib_frmr *frmr;
> > - int err = 0;
> > + int err;
>
> Can we trust it'll be zero?
No need. With the change below there is always an assignment before the
only reference at the end of the function.
julia
>
> >
> > if (npages <= RDS_MR_8K_MSG_SIZE)
> > pool = rds_ibdev->mr_8k_pool;
> > @@ -61,6 +61,7 @@ static struct rds_ib_mr *rds_ib_alloc_frmr(struct rds_ib_device *rds_ibdev,
> > pool->fmr_attr.max_pages);
> > if (IS_ERR(frmr->mr)) {
> > pr_warn("RDS/IB: %s failed to allocate MR", __func__);
> > + err = -ENOMEM;
> > goto out_no_cigar;
> > }
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> > the body of a message to majordomo@xxxxxxxxxxxxxxx
> > More majordomo info at http://vger.kernel.org/majordomo-info.html
> --
> To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
