linux-kernel - Re: [PATCH 1/1] infiniband: hw: mlx4: fix improper return value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 4 Dec 2016 08:15:01 +0200
From:   Leon Romanovsky <leon@...nel.org>
To:     Pan Bian <bianpan201603@....com>
Cc:     Yishai Hadas <yishaih@...lanox.com>,
        Doug Ledford <dledford@...hat.com>,
        Sean Hefty <sean.hefty@...el.com>,
        Hal Rosenstock <hal.rosenstock@...il.com>,
        linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org,
        Pan Bian <bianpan2016@....com>
Subject: Re: [PATCH 1/1] infiniband: hw: mlx4: fix improper return value

On Sun, Dec 04, 2016 at 01:49:04PM +0800, Pan Bian wrote:
> From: Pan Bian <bianpan2016@....com>
>
> If uhw->inlen is non-zero, the value of variable err is 0 if the copy
> succeeds. Then, if kzalloc() or kmalloc() returns a NULL pointer, it
> will return 0 to the callers. As a result, the callers cannot detect the
> errors. This patch fixes the bug, assigning "-ENOMEM" to err before
> the NULL pointer checks.
>
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189031
>
> Signed-off-by: Pan Bian <bianpan2016@....com>
> ---
>  drivers/infiniband/hw/mlx4/main.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
> index b597e82..f6c5158 100644
> --- a/drivers/infiniband/hw/mlx4/main.c
> +++ b/drivers/infiniband/hw/mlx4/main.c
> @@ -455,6 +455,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
>  		sizeof(resp.response_length);
>  	in_mad  = kzalloc(sizeof *in_mad, GFP_KERNEL);
>  	out_mad = kmalloc(sizeof *out_mad, GFP_KERNEL);
> +	err = -ENOMEM;
>  	if (!in_mad || !out_mad)
>  		goto out;

In such case, the err initialization at the beginning of
mlx4_ib_query_device function is not necessary. Can you please remove it?

Besides that, look good.
Reviewed-by: Leon Romanovsky <leonro@...lanox.com>

>
> --
> 1.9.1
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)