aboutsummaryrefslogtreecommitdiff
path: root/drivers/infiniband
diff options
context:
space:
mode:
authorNicholas Bellinger2016-01-06 10:25:43 -0800
committerNicholas Bellinger2016-01-07 13:57:51 -0800
commit373a4cd7378220d3c5a69fd369b1d78fee3207b2 (patch)
tree5e9905ca689767da95d7e69dd05a67412503a0eb /drivers/infiniband
parent091b70623e2b9caee1c27190c3a5614b3563a672 (diff)
iser-target: Fix non negative ERR_PTR isert_device_get usage
As reported by Dan, isert_create_device_ib_res() failure within isert_device_get() can potentially return a postive value, resulting in ERR_PTR() triggering a NULL pointer dereference. Caught by the static checker: drivers/infiniband/ulp/isert/ib_isert.c:423 isert_device_get() error: passing non negative 1 to ERR_PTR Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Sagi Grimberg <sagig@mellanox.com> Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r--drivers/infiniband/ulp/isert/ib_isert.c7
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index dfbbbb28090b..ae84de12e70e 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -357,7 +357,7 @@ isert_create_device_ib_res(struct isert_device *device)
dev_attr = &device->dev_attr;
ret = isert_query_device(device->ib_device, dev_attr);
if (ret)
- return ret;
+ goto out;
/* asign function handlers */
if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS &&
@@ -373,7 +373,7 @@ isert_create_device_ib_res(struct isert_device *device)
ret = isert_alloc_comps(device, dev_attr);
if (ret)
- return ret;
+ goto out;
device->pd = ib_alloc_pd(device->ib_device);
if (IS_ERR(device->pd)) {
@@ -391,6 +391,9 @@ isert_create_device_ib_res(struct isert_device *device)
out_cq:
isert_free_comps(device);
+out:
+ if (ret > 0)
+ ret = -EINVAL;
return ret;
}