From: Pan Bian <[email protected]>
In function c4iw_rdev_open(), the value of return variable err should be
negative on errors. However, when the call to __get_free_page() returns
a NULL pointer, its value is not set to "-ENOMEM" and keeps 0. 0 means
no error. And thus, the behavior of its caller may be misled. This patch
fixes the bug.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188821
Signed-off-by: Pan Bian <[email protected]>
---
drivers/infiniband/hw/cxgb4/device.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 93e3d27..b99dc9e 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -828,8 +828,10 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
}
rdev->status_page = (struct t4_dev_status_page *)
__get_free_page(GFP_KERNEL);
- if (!rdev->status_page)
+ if (!rdev->status_page) {
+ err = -ENOMEM;
goto destroy_ocqp_pool;
+ }
rdev->status_page->qp_start = rdev->lldi.vr->qp.start;
rdev->status_page->qp_size = rdev->lldi.vr->qp.size;
rdev->status_page->cq_start = rdev->lldi.vr->cq.start;
--
1.9.1
Acked-by: Steve Wise <[email protected]>
On 12/3/2016 8:04 AM, Pan Bian wrote:
> From: Pan Bian <[email protected]>
>
> In function c4iw_rdev_open(), the value of return variable err should be
> negative on errors. However, when the call to __get_free_page() returns
> a NULL pointer, its value is not set to "-ENOMEM" and keeps 0. 0 means
> no error. And thus, the behavior of its caller may be misled. This patch
> fixes the bug.
>
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188821
>
> Signed-off-by: Pan Bian <[email protected]>
> ---
> drivers/infiniband/hw/cxgb4/device.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
> index 93e3d27..b99dc9e 100644
> --- a/drivers/infiniband/hw/cxgb4/device.c
> +++ b/drivers/infiniband/hw/cxgb4/device.c
> @@ -828,8 +828,10 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev)
> }
> rdev->status_page = (struct t4_dev_status_page *)
> __get_free_page(GFP_KERNEL);
> - if (!rdev->status_page)
> + if (!rdev->status_page) {
> + err = -ENOMEM;
> goto destroy_ocqp_pool;
> + }
> rdev->status_page->qp_start = rdev->lldi.vr->qp.start;
> rdev->status_page->qp_size = rdev->lldi.vr->qp.size;
> rdev->status_page->cq_start = rdev->lldi.vr->cq.start;
>
This fix was previously submitted by Wei Yongjun.
--
Doug Ledford <[email protected]>
GPG Key ID: 0E572FDD