iser-target: Fix non negative ERR_PTR isert_device_get usage (373a4cd7) · Commits · 戴 / test

As reported by Dan, isert_create_device_ib_res() failure within isert_device_get() can potentially return a postive value, resulting in ERR_PTR() triggering a NULL pointer dereference. Caught by the static checker: drivers/infiniband/ulp/isert/ib_isert.c:423 isert_device_get() error: passing non negative 1 to ERR_PTR Reported-by:

Dan Carpenter <dan.carpenter@oracle.com> Cc: Sagi Grimberg <sagig@mellanox.com> Signed-off-by:

Nicholas Bellinger <nab@linux-iscsi.org>

drivers/infiniband/ulp/isert/ib_isert.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -357,7 +357,7 @@ isert_create_device_ib_res(struct isert_device *device)
		dev_attr = &device->dev_attr;
		ret = isert_query_device(device->ib_device, dev_attr);
		if (ret)
		return ret;
		goto out;

		/* asign function handlers */
		if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS &&
		@@ -373,7 +373,7 @@ isert_create_device_ib_res(struct isert_device *device)

		ret = isert_alloc_comps(device, dev_attr);
		if (ret)
		return ret;
		goto out;

		device->pd = ib_alloc_pd(device->ib_device);
		if (IS_ERR(device->pd)) {
		@@ -391,6 +391,9 @@ isert_create_device_ib_res(struct isert_device *device)

		out_cq:
		isert_free_comps(device);
		out:
		if (ret > 0)
		ret = -EINVAL;
		return ret;
		}

Admin message