Received-SPF: pass (google.com: domain of linux-kernel+bounces-13667-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Message-ID: <ef8b36bf-d9d7-46a4-9648-7cc8aaa8a980@web.de>
Date: Sun, 31 Dec 2023 10:38:10 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-GB
To: kernel-janitors@vger.kernel.org,
 =?UTF-8?Q?Ahelenia_Ziemia=C5=84ska?= <nabijaczleweli@nabijaczleweli.xyz>,
 Andrew Morton <akpm@linux-foundation.org>, Li kunyu <kunyu@nfschina.com>,
 Michal Hocko <mhocko@suse.com>,
 Sebastian Reichel <sebastian.reichel@collabora.com>,
 Suren Baghdasaryan <surenb@google.com>,
 Zhang Zhengming <zhang.zhengming@h3c.com>, Zhou Kete <zhou.kete@h3c.com>
Cc: LKML <linux-kernel@vger.kernel.org>
From: Markus Elfring <Markus.Elfring@web.de>
Subject: [PATCH] kernel: relay: Improve exception handling in
 relay_create_buf()
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:TE4FyJwHFpY=;R4C80PLXC7bNJoaCP+76mtDrUir
 fEpQqTxyHJMHQ2IxBrS4diRWjF/UT49k7QmyZsscFMyyurPN576Jy6jI5yuw+VOJb8/UcoC4R
 6TnARN8eRw7Lx7/P7JgfSV0/BCsKkvZhJ6Ug173NXzcWEuZYe4W5e7hk9+JKaoeA1wdxIpjwJ
 Rk3iwA0m3QGxGjAL7g7BWZDnWQNkKhUuB5UBtotAfsgZsyGZJpmmse48saakQ5S2fRua9FHD4
 jX8OC3lAJOjFGtxuOHtzZK0TJZjN2cjeOYcxRhWFE2ZQk4gBLOt3ab2l3yFvfGaCooVI6Dnt5
 irkZSoZjlQXCRIG1E3uLNfaEe2uh1YcbVsJikE7s4rR/2K/NmjRZgn9gSm/1bfFB4nbsg7fLj
 swiXAGmG+rhqe56HeIHES//KUia2EBgkEGe1kiUJN2Fi7GWNCu2mDay9lG4K99oNUhQQpAHj4
 4PzuSgYKRG5lrS2O4u6xH1LXf0J5fUlgPgjmSlBlgDYkaRBAB5kwJjm6ALYUG3HisJtdGBot8
 sUUq5iuC9/zxo9b5QDvJJBXUOAFsUSdiByNDiLZ/Uhsz7D8pRSdkir6aPXg6+v2SzYmJJEmCk
 +AKtb/506clg487Bl404M6Ok4gni/NRnRcFjciuwNfI4CGNBUS/3EvtNDnt88xIvHSPTC1tk+
 aIYLouH2uynh3KdAavByEu1sLoGHTCzXcWpIk/AWx15StY9wM1qEOdCRcRfPGDoNc3jjsOdX7
 ITlNc6O2smWyIu3X7MMJYPZWSB4mEASyVeRoFh9q+Dhf7yS+hCJAxrCL+hESDUz0bdaS9MUjP
 uZSF8xCVgBd/+UYOftuqAYdybiLZPVIJ+/qeLVBFYNUbTiBiJSIt4WqT2sF0w4HmrGMMUKP8d
 JB3eiaxvzF45dn8BiwxraZRSETN3qopjIB2gvlYf7CaVlSB/nPoF8cC6C1PwP1Zv3v6eNRmXq
 6s1h+QOihtOGG0yzIvNPlzt2tJ0=

From: Markus Elfring <elfring@users.sourceforge.net>
Date: Sun, 31 Dec 2023 10:26:25 +0100

The kfree() function was called in one case by
the relay_create_buf() function during error handling
even if the passed data structure member contained a null pointer.
This issue was detected by using the Coccinelle software.

Thus use another label.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
=2D--
 kernel/relay.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/relay.c b/kernel/relay.c
index a8e90e98bf2c..b8c06305213d 100644
=2D-- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -161,14 +161,15 @@ static struct rchan_buf *relay_create_buf(struct rch=
an *chan)

 	buf->start =3D relay_alloc_buf(buf, &chan->alloc_size);
 	if (!buf->start)
-		goto free_buf;
+		goto free_padding;

 	buf->chan =3D chan;
 	kref_get(&buf->chan->kref);
 	return buf;

-free_buf:
+free_padding:
 	kfree(buf->padding);
+free_buf:
 	kfree(buf);
 	return NULL;
 }
=2D-
2.43.0