Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S971437AbdDWQvj (ORCPT ); Sun, 23 Apr 2017 12:51:39 -0400 Received: from mail.kernel.org ([198.145.29.136]:58460 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S971373AbdDWQva (ORCPT ); Sun, 23 Apr 2017 12:51:30 -0400 Date: Sun, 23 Apr 2017 19:51:41 +0300 From: Leon Romanovsky To: Pan Bian Cc: Steve Wise , Doug Ledford , Sean Hefty , Hal Rosenstock , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 1/1] iw_cxgb4: check return value of alloc_skb Message-ID: <20170423165141.GG14088@mtr-leonro.local> References: <1492938551-17824-1-git-send-email-bianpan2016@163.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="GD+uNaHYxbVPHaQt" Content-Disposition: inline In-Reply-To: <1492938551-17824-1-git-send-email-bianpan2016@163.com> User-Agent: Mutt/1.8.0 (2017-02-23) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2260 Lines: 60 --GD+uNaHYxbVPHaQt Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Sun, Apr 23, 2017 at 05:09:11PM +0800, Pan Bian wrote: > Function alloc_skb() will return a NULL pointer when there is no enough > memory. However, the return value of alloc_skb() is directly used > without validation in function send_fw_pass_open_req(). This patches > checks the return value of alloc_skb() against NULL. > > Signed-off-by: Pan Bian > --- > drivers/infiniband/hw/cxgb4/cm.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c > index 03a1b0e..196969c 100644 > --- a/drivers/infiniband/hw/cxgb4/cm.c > +++ b/drivers/infiniband/hw/cxgb4/cm.c > @@ -3800,6 +3800,8 @@ static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb, > int ret; > > req_skb = alloc_skb(sizeof(struct fw_ofld_connection_wr), GFP_KERNEL); > + if (!req_skb) > + return; The check is right, but the outcome is unpredictable. The function send_fw_pass_open_req() doesn't return any error and caller doesn't check it. > req = (struct fw_ofld_connection_wr *)__skb_put(req_skb, sizeof(*req)); > memset(req, 0, sizeof(*req)); > req->op_compl = htonl(WR_OP_V(FW_OFLD_CONNECTION_WR) | FW_WR_COMPL_F); > -- > 1.9.1 > > --GD+uNaHYxbVPHaQt Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEkhr/r4Op1/04yqaB5GN7iDZyWKcFAlj8250ACgkQ5GN7iDZy WKdXyBAAgKInHgfqJo9VgRpjqxnX7ETAVw1IsCCFDEkrZpR20xAAMdYC3Tm60T8H FL4Jemfgy3Z9r483Ugzhn9BJ4jdutuybHSHQSGNuyY4n4b5tyRa89dbBun13QWdL GYXu08X1c/9ayMvZ5pLCQRDE84G4f1Ga6CWEYmQ6uQf15xVRaJ9ihiKixLxtcOTS NTcC9jDzw68uQ92Py1pFTdptner7X8H29lo2hm+FiqsaGxIO5QQvQPHpFwqwrjX5 zc3ezih/ntRlgoWGh8vB2OdYpazZf56fMoQ2WQqNKipr543d7VgWhgO1Aa+GdO7f VF8Y9q9NEEzU3Dg4qvFKrsElKL5HDCgT10OGmBzbj6gEG66vOnXbuRaNlnAzvNv2 FkbtcjSbf7bM1GWGcO9p7ab7SuZpKvZfnp9cSFUMQTmEO7gPo1eJZzBjF3vyrKfg WRBlBi+YLDt4TdEIT6hUI5JIO7Mx/lMwU5H/oBVE0zYZ+UpS1o885MS5WX2BOAfM oXJ+XF3GYPSyu90KDx/piBAmKB9xmL0UF7tMeH5xWztcvG970HkmbxL2XdwTA5Uj RcmPW1hv8vaclgczzHnXaudEG484axXvG8eb91SZgCMNNnCeGv2rHv1ajkKZ3jO5 0WALb5M7Es7b4AK12a9O/6Ut9bbgWED4ElyzTVrIK+GMKCL8XeA= =vWGU -----END PGP SIGNATURE----- --GD+uNaHYxbVPHaQt--