From: Nicholas Bellinger Date: Wed, 6 Jan 2016 18:25:43 +0000 (-0800) Subject: iser-target: Fix non negative ERR_PTR isert_device_get usage X-Git-Tag: v4.14-rc1~3968^2~14 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=373a4cd7378220d3c5a69fd369b1d78fee3207b2;p=platform%2Fkernel%2Flinux-rpi.git iser-target: Fix non negative ERR_PTR isert_device_get usage As reported by Dan, isert_create_device_ib_res() failure within isert_device_get() can potentially return a postive value, resulting in ERR_PTR() triggering a NULL pointer dereference. Caught by the static checker: drivers/infiniband/ulp/isert/ib_isert.c:423 isert_device_get() error: passing non negative 1 to ERR_PTR Reported-by: Dan Carpenter Cc: Sagi Grimberg Signed-off-by: Nicholas Bellinger --- diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index dfbbbb2..ae84de1 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -357,7 +357,7 @@ isert_create_device_ib_res(struct isert_device *device) dev_attr = &device->dev_attr; ret = isert_query_device(device->ib_device, dev_attr); if (ret) - return ret; + goto out; /* asign function handlers */ if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS && @@ -373,7 +373,7 @@ isert_create_device_ib_res(struct isert_device *device) ret = isert_alloc_comps(device, dev_attr); if (ret) - return ret; + goto out; device->pd = ib_alloc_pd(device->ib_device); if (IS_ERR(device->pd)) { @@ -391,6 +391,9 @@ isert_create_device_ib_res(struct isert_device *device) out_cq: isert_free_comps(device); +out: + if (ret > 0) + ret = -EINVAL; return ret; }