Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1044367AbdDWJJp (ORCPT ); Sun, 23 Apr 2017 05:09:45 -0400 Received: from m50-135.163.com ([123.125.50.135]:59417 "EHLO m50-135.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1044288AbdDWJJ3 (ORCPT ); Sun, 23 Apr 2017 05:09:29 -0400 From: Pan Bian To: Steve Wise , Doug Ledford , Sean Hefty , Hal Rosenstock Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, Pan Bian Subject: [PATCH 1/1] iw_cxgb4: check return value of alloc_skb Date: Sun, 23 Apr 2017 17:09:11 +0800 Message-Id: <1492938551-17824-1-git-send-email-bianpan2016@163.com> X-Mailer: git-send-email 1.9.1 X-CM-TRANSID: D9GowACn0_E3b_xYVi1+AA--.461S3 X-Coremail-Antispam: 1Uf129KBjvdXoW7XFWxKFyfWFy3uF43Gw1UAwb_yoWDCFg_uF W8ZFWxWr1fCrn5Cr4DKF47Wr9FvF42v3s7ZwnIq3W3AFy3Wwn5A34ktFn5Gw47XrWxCFn8 CrWq9r1furyagjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IUbvJm5UUUUU== X-Originating-IP: [123.118.194.153] X-CM-SenderInfo: held01tdqsiiqw6rljoofrz/1tbiDhrCclXljDuLDwAAsn Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 977 Lines: 26 Function alloc_skb() will return a NULL pointer when there is no enough memory. However, the return value of alloc_skb() is directly used without validation in function send_fw_pass_open_req(). This patches checks the return value of alloc_skb() against NULL. Signed-off-by: Pan Bian --- drivers/infiniband/hw/cxgb4/cm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index 03a1b0e..196969c 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -3800,6 +3800,8 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb, int ret; req_skb = alloc_skb(sizeof(struct fw_ofld_connection_wr), GFP_KERNEL); + if (!req_skb) + return; req = (struct fw_ofld_connection_wr *)__skb_put(req_skb, sizeof(*req)); memset(req, 0, sizeof(*req)); req->op_compl = htonl(WR_OP_V(FW_OFLD_CONNECTION_WR) | FW_WR_COMPL_F); -- 1.9.1