MIME-Version: 1.0
References: <20230226102338.3362585-1-void0red@gmail.com>
In-Reply-To: <20230226102338.3362585-1-void0red@gmail.com>
From:   Justin Tee <justintee8345@gmail.com>
Date:   Mon, 27 Feb 2023 20:12:21 -0800
Message-ID: <CABPRKS84yaatW-PD19aH4SdB5hfmZEUFYXqj8fX+QTUgLmy43w@mail.gmail.com>
Subject: Re: [PATCH] scsi: lpfc: add null check of kzalloc in lpfc_sli4_cgn_params_read
To:     Kang Chen <void0red@gmail.com>
Cc:     jejb@linux.ibm.com, martin.petersen@oracle.com,
        james.smart@broadcom.com, dick.kennedy@broadcom.com,
        linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
        Justin Tee <justin.tee@broadcom.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Kang,

Thanks for reporting this.

Technically, the lpfc_read_object routine already NULL checks pdata,
and if it was NULL would return -ENODEV.  Then, else if (ret < 0)
would evaluate to true and we'd goto rd_obj_err.

However, we like the suggestion to return -ENOMEM instead.  I will
post a v2 of this patch to address both concerns.

Thanks,
Justin

On Sun, Feb 26, 2023 at 2:48=E2=80=AFAM Kang Chen <void0red@gmail.com> wrot=
e:
>
> kzalloc may fails, pdata might be null and it may cause
> null pointer dereference later.
>
> Signed-off-by: Kang Chen <void0red@gmail.com>
> ---
>  drivers/scsi/lpfc/lpfc_init.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.=
c
> index 6eb4085a3..54134d782 100644
> --- a/drivers/scsi/lpfc/lpfc_init.c
> +++ b/drivers/scsi/lpfc/lpfc_init.c
> @@ -7291,6 +7291,8 @@ lpfc_sli4_cgn_params_read(struct lpfc_hba *phba)
>         /* Find out if the FW has a new set of congestion parameters. */
>         len =3D sizeof(struct lpfc_cgn_param);
>         pdata =3D kzalloc(len, GFP_KERNEL);
> +       if (!pdata)
> +               return -ENOMEM;
>         ret =3D lpfc_read_object(phba, (char *)LPFC_PORT_CFG_NAME,
>                                pdata, len);
>
> --
> 2.34.1
>