dect/linux-2.6
Archived
14
0
Fork 0
Code Releases Activity

RDMA/amso1100: Check kmalloc() result in c2_register_device()

Browse source 
dev->ibdev.iwcm allocation may fail, prevent a dereference.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Roel Kluin 2009-09-05 20:24:24 -07:00 committed by Roland Dreier
parent b1b8afb833
commit 1493ab4083
1 changed files with 15 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
drivers/infiniband/hw/amso1100/c2_provider.c
View file

@ -780,11 +780,11 @@ int c2_register_device(struct c2_dev *dev)
/* Register pseudo network device */ /* Register pseudo network device */
dev->pseudo_netdev = c2_pseudo_netdev_init(dev); dev->pseudo_netdev = c2_pseudo_netdev_init(dev);
if (!dev->pseudo_netdev) if (!dev->pseudo_netdev)
goto out3; goto out;
ret = register_netdev(dev->pseudo_netdev); ret = register_netdev(dev->pseudo_netdev);
if (ret) if (ret)
goto out2; goto out_free_netdev;
pr_debug("%s:%u\n", __func__, __LINE__); pr_debug("%s:%u\n", __func__, __LINE__);
strlcpy(dev->ibdev.name, "amso%d", IB_DEVICE_NAME_MAX); strlcpy(dev->ibdev.name, "amso%d", IB_DEVICE_NAME_MAX);
@ -851,6 +851,10 @@ int c2_register_device(struct c2_dev *dev)
dev->ibdev.post_recv = c2_post_receive; dev->ibdev.post_recv = c2_post_receive;
dev->ibdev.iwcm = kmalloc(sizeof(*dev->ibdev.iwcm), GFP_KERNEL); dev->ibdev.iwcm = kmalloc(sizeof(*dev->ibdev.iwcm), GFP_KERNEL);
if (dev->ibdev.iwcm == NULL) {
ret = -ENOMEM;
goto out_unregister_netdev;
}
dev->ibdev.iwcm->add_ref = c2_add_ref; dev->ibdev.iwcm->add_ref = c2_add_ref;
dev->ibdev.iwcm->rem_ref = c2_rem_ref; dev->ibdev.iwcm->rem_ref = c2_rem_ref;
dev->ibdev.iwcm->get_qp = c2_get_qp; dev->ibdev.iwcm->get_qp = c2_get_qp;
@ -862,23 +866,25 @@ int c2_register_device(struct c2_dev *dev)
ret = ib_register_device(&dev->ibdev); ret = ib_register_device(&dev->ibdev);
if (ret) if (ret)
goto out1; goto out_free_iwcm;
for (i = 0; i < ARRAY_SIZE(c2_dev_attributes); ++i) { for (i = 0; i < ARRAY_SIZE(c2_dev_attributes); ++i) {
ret = device_create_file(&dev->ibdev.dev, ret = device_create_file(&dev->ibdev.dev,
c2_dev_attributes[i]); c2_dev_attributes[i]);
if (ret) if (ret)
goto out0; goto out_unregister_ibdev;
} }
goto out3; goto out;
out0: out_unregister_ibdev:
ib_unregister_device(&dev->ibdev); ib_unregister_device(&dev->ibdev);
out1: out_free_iwcm:
kfree(dev->ibdev.iwcm);
out_unregister_netdev:
unregister_netdev(dev->pseudo_netdev); unregister_netdev(dev->pseudo_netdev);
out2: out_free_netdev:
free_netdev(dev->pseudo_netdev); free_netdev(dev->pseudo_netdev);
out3: out:
pr_debug("%s:%u ret=%d\n", __func__, __LINE__, ret); pr_debug("%s:%u ret=%d\n", __func__, __LINE__, ret);
return ret; return ret;
} }