On Wed, Feb 13, 2019 at 06:29:22PM -0800, Bart Van Assche wrote:
> On 1/10/19 10:21 PM, Leon Romanovsky wrote:
> > +++ b/drivers/infiniband/core/uverbs_cmd.c
> > @@ -60,6 +60,10 @@ static int uverbs_response(struct uverbs_attr_bundle *attrs, const void *resp,
> > {
> > int ret;
> > + if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
> > + return uverbs_copy_to_struct_or_zero(
> > + attrs, UVERBS_ATTR_CORE_OUT, resp, resp_len);
> > +
> > if (copy_to_user(attrs->ucore.outbuf, resp,
> > min(attrs->ucore.outlen, resp_len)))
> > return -EFAULT;
> > @@ -1181,6 +1185,9 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs)
> > goto out_put;
> > }
> > + if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
> > + ret = uverbs_output_written(attrs, UVERBS_ATTR_CORE_OUT);
> > +
> > ret = 0;
>
> Hi Leon,
>
> Coverity reports about this code that the value returned by
> uverbs_output_written() is overwritten before it is used.
Indeed, the ret = 0 should be done before the if.
Jason
