* [PATCH] IB/rxe: check for allocation failure on elem
@ 2017-09-08 14:37 ` Colin King
0 siblings, 0 replies; 16+ messages in thread
From: Colin King @ 2017-09-08 14:37 UTC (permalink / raw)
To: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
The allocation for elem may fail (especially because we're using
GFP_ATOMIC) so best to check for a null return. This fixes a potential
null pointer dereference when assigning elem->pool.
Detected by CoverityScan CID#1357507 ("Dereference null return value")
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
index c1b5f38f31a5..3b4916680018 100644
--- a/drivers/infiniband/sw/rxe/rxe_pool.c
+++ b/drivers/infiniband/sw/rxe/rxe_pool.c
@@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool)
elem = kmem_cache_zalloc(pool_cache(pool),
(pool->flags & RXE_POOL_ATOMIC) ?
GFP_ATOMIC : GFP_KERNEL);
+ if (!elem)
+ return NULL;
elem->pool = pool;
kref_init(&elem->ref_cnt);
--
2.14.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH] IB/rxe: check for allocation failure on elem @ 2017-09-08 14:37 ` Colin King 0 siblings, 0 replies; 16+ messages in thread From: Colin King @ 2017-09-08 14:37 UTC (permalink / raw) To: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma Cc: kernel-janitors, linux-kernel From: Colin Ian King <colin.king@canonical.com> The allocation for elem may fail (especially because we're using GFP_ATOMIC) so best to check for a null return. This fixes a potential null pointer dereference when assigning elem->pool. Detected by CoverityScan CID#1357507 ("Dereference null return value") Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Colin Ian King <colin.king@canonical.com> --- drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c index c1b5f38f31a5..3b4916680018 100644 --- a/drivers/infiniband/sw/rxe/rxe_pool.c +++ b/drivers/infiniband/sw/rxe/rxe_pool.c @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) elem = kmem_cache_zalloc(pool_cache(pool), (pool->flags & RXE_POOL_ATOMIC) ? GFP_ATOMIC : GFP_KERNEL); + if (!elem) + return NULL; elem->pool = pool; kref_init(&elem->ref_cnt); -- 2.14.1 ^ permalink raw reply related [flat|nested] 16+ messages in thread
[parent not found: <20170908143745.2445-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>]
* Re: [PATCH] IB/rxe: check for allocation failure on elem [not found] ` <20170908143745.2445-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> 2017-09-09 12:56 ` Leon Romanovsky @ 2017-09-09 12:56 ` Leon Romanovsky 0 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-09-09 12:56 UTC (permalink / raw) To: Colin King Cc: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma-u79uwXL29TY76Z2rM5mHXA, kernel-janitors-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA [-- Attachment #1: Type: text/plain, Size: 1174 bytes --] On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > The allocation for elem may fail (especially because we're using > GFP_ATOMIC) so best to check for a null return. This fixes a potential > null pointer dereference when assigning elem->pool. > > Detected by CoverityScan CID#1357507 ("Dereference null return value") > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index c1b5f38f31a5..3b4916680018 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > + if (!elem) > + return NULL; > It is not enough to simply return NULL, you also should release "pool" too. Thanks > elem->pool = pool; > kref_init(&elem->ref_cnt); > -- > 2.14.1 > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-09-09 12:56 ` Leon Romanovsky 0 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-09-09 12:56 UTC (permalink / raw) To: Colin King Cc: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel [-- Attachment #1: Type: text/plain, Size: 1174 bytes --] On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > The allocation for elem may fail (especially because we're using > GFP_ATOMIC) so best to check for a null return. This fixes a potential > null pointer dereference when assigning elem->pool. > > Detected by CoverityScan CID#1357507 ("Dereference null return value") > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > Signed-off-by: Colin Ian King <colin.king@canonical.com> > --- > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index c1b5f38f31a5..3b4916680018 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > + if (!elem) > + return NULL; > It is not enough to simply return NULL, you also should release "pool" too. Thanks > elem->pool = pool; > kref_init(&elem->ref_cnt); > -- > 2.14.1 > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-09-09 12:56 ` Leon Romanovsky 0 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-09-09 12:56 UTC (permalink / raw) To: Colin King Cc: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma-u79uwXL29TY76Z2rM5mHXA, kernel-janitors-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA [-- Attachment #1: Type: text/plain, Size: 1226 bytes --] On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > From: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > > The allocation for elem may fail (especially because we're using > GFP_ATOMIC) so best to check for a null return. This fixes a potential > null pointer dereference when assigning elem->pool. > > Detected by CoverityScan CID#1357507 ("Dereference null return value") > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > Signed-off-by: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > --- > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index c1b5f38f31a5..3b4916680018 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > + if (!elem) > + return NULL; > It is not enough to simply return NULL, you also should release "pool" too. Thanks > elem->pool = pool; > kref_init(&elem->ref_cnt); > -- > 2.14.1 > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem 2017-09-09 12:56 ` Leon Romanovsky @ 2017-09-12 14:48 ` Leon Romanovsky -1 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-09-12 14:48 UTC (permalink / raw) To: Colin King Cc: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel [-- Attachment #1: Type: text/plain, Size: 1373 bytes --] On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: > On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > > From: Colin Ian King <colin.king@canonical.com> > > > > The allocation for elem may fail (especially because we're using > > GFP_ATOMIC) so best to check for a null return. This fixes a potential > > null pointer dereference when assigning elem->pool. > > > > Detected by CoverityScan CID#1357507 ("Dereference null return value") > > > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > > --- > > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > > index c1b5f38f31a5..3b4916680018 100644 > > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > > elem = kmem_cache_zalloc(pool_cache(pool), > > (pool->flags & RXE_POOL_ATOMIC) ? > > GFP_ATOMIC : GFP_KERNEL); > > + if (!elem) > > + return NULL; > > > > It is not enough to simply return NULL, you also should release "pool" too. Colin, do you plan to fix the comment and resend it? Thanks > > Thanks > > > elem->pool = pool; > > kref_init(&elem->ref_cnt); > > -- > > 2.14.1 > > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-09-12 14:48 ` Leon Romanovsky 0 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-09-12 14:48 UTC (permalink / raw) To: Colin King Cc: Moni Shoua, Doug Ledford, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel [-- Attachment #1: Type: text/plain, Size: 1373 bytes --] On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: > On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > > From: Colin Ian King <colin.king@canonical.com> > > > > The allocation for elem may fail (especially because we're using > > GFP_ATOMIC) so best to check for a null return. This fixes a potential > > null pointer dereference when assigning elem->pool. > > > > Detected by CoverityScan CID#1357507 ("Dereference null return value") > > > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > > --- > > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > > index c1b5f38f31a5..3b4916680018 100644 > > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > > elem = kmem_cache_zalloc(pool_cache(pool), > > (pool->flags & RXE_POOL_ATOMIC) ? > > GFP_ATOMIC : GFP_KERNEL); > > + if (!elem) > > + return NULL; > > > > It is not enough to simply return NULL, you also should release "pool" too. Colin, do you plan to fix the comment and resend it? Thanks > > Thanks > > > elem->pool = pool; > > kref_init(&elem->ref_cnt); > > -- > > 2.14.1 > > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem 2017-09-12 14:48 ` Leon Romanovsky @ 2017-10-09 13:16 ` Doug Ledford -1 siblings, 0 replies; 16+ messages in thread From: Doug Ledford @ 2017-10-09 13:16 UTC (permalink / raw) To: Leon Romanovsky, Colin King Cc: Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel On Tue, 2017-09-12 at 17:48 +0300, Leon Romanovsky wrote: > On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: > > On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > > > From: Colin Ian King <colin.king@canonical.com> > > > > > > The allocation for elem may fail (especially because we're using > > > GFP_ATOMIC) so best to check for a null return. This fixes a > > > potential > > > null pointer dereference when assigning elem->pool. > > > > > > Detected by CoverityScan CID#1357507 ("Dereference null return > > > value") > > > > > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > > > --- > > > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c > > > b/drivers/infiniband/sw/rxe/rxe_pool.c > > > index c1b5f38f31a5..3b4916680018 100644 > > > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > > > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > > > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > > > elem = kmem_cache_zalloc(pool_cache(pool), > > > (pool->flags & RXE_POOL_ATOMIC) > > > ? > > > GFP_ATOMIC : GFP_KERNEL); > > > + if (!elem) > > > + return NULL; > > > > > > > It is not enough to simply return NULL, you also should release > > "pool" too. > > Colin, > do you plan to fix the comment and resend it? Since Colin is non-responsive in this thread, I went ahead and took his patch, but then applied a fixup of my own: commit a79c0f939da23740c12f43019720055aade89367 (HEAD -> k.o/for-next) Author: Doug Ledford <dledford@redhat.com> Date: Mon Oct 9 09:11:32 2017 -0400 IB/rxe: put the pool on allocation failure If the allocation of elem fails, it is not sufficient to simply check for NULL and return. We need to also put our reference on the pool or else we will leave the pool with a permanent ref count and we will never be able to free it. Fixes: 4831ca9e4a8e (IB/rxe: check for allocation failure on elem) Suggested-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com> diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c index 3b4916680018..b4a8acc7bb7d 100644 --- a/drivers/infiniband/sw/rxe/rxe_pool.c +++ b/drivers/infiniband/sw/rxe/rxe_pool.c @@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool) kref_get(&pool->rxe->ref_cnt); - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { - atomic_dec(&pool->num_elem); - rxe_dev_put(pool->rxe); - rxe_pool_put(pool); - return NULL; - } + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) + goto out_put_pool; elem = kmem_cache_zalloc(pool_cache(pool), (pool->flags & RXE_POOL_ATOMIC) ? GFP_ATOMIC : GFP_KERNEL); if (!elem) - return NULL; + goto out_put_pool; elem->pool = pool; kref_init(&elem->ref_cnt); return elem; + +out_put_pool: + atomic_dec(&pool->num_elem); + rxe_dev_put(pool->rxe); + rxe_pool_put(pool); + return NULL; } void rxe_elem_release(struct kref *kref) -- Doug Ledford <dledford@redhat.com> GPG KeyID: B826A3330E572FDD Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD ^ permalink raw reply related [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-10-09 13:16 ` Doug Ledford 0 siblings, 0 replies; 16+ messages in thread From: Doug Ledford @ 2017-10-09 13:16 UTC (permalink / raw) To: Leon Romanovsky, Colin King Cc: Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel On Tue, 2017-09-12 at 17:48 +0300, Leon Romanovsky wrote: > On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: > > On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > > > From: Colin Ian King <colin.king@canonical.com> > > > > > > The allocation for elem may fail (especially because we're using > > > GFP_ATOMIC) so best to check for a null return. This fixes a > > > potential > > > null pointer dereference when assigning elem->pool. > > > > > > Detected by CoverityScan CID#1357507 ("Dereference null return > > > value") > > > > > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > > > --- > > > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c > > > b/drivers/infiniband/sw/rxe/rxe_pool.c > > > index c1b5f38f31a5..3b4916680018 100644 > > > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > > > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > > > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > > > elem = kmem_cache_zalloc(pool_cache(pool), > > > (pool->flags & RXE_POOL_ATOMIC) > > > ? > > > GFP_ATOMIC : GFP_KERNEL); > > > + if (!elem) > > > + return NULL; > > > > > > > It is not enough to simply return NULL, you also should release > > "pool" too. > > Colin, > do you plan to fix the comment and resend it? Since Colin is non-responsive in this thread, I went ahead and took his patch, but then applied a fixup of my own: commit a79c0f939da23740c12f43019720055aade89367 (HEAD -> k.o/for-next) Author: Doug Ledford <dledford@redhat.com> Date: Mon Oct 9 09:11:32 2017 -0400 IB/rxe: put the pool on allocation failure If the allocation of elem fails, it is not sufficient to simply check for NULL and return. We need to also put our reference on the pool or else we will leave the pool with a permanent ref count and we will never be able to free it. Fixes: 4831ca9e4a8e (IB/rxe: check for allocation failure on elem) Suggested-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Doug Ledford <dledford@redhat.com> diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c index 3b4916680018..b4a8acc7bb7d 100644 --- a/drivers/infiniband/sw/rxe/rxe_pool.c +++ b/drivers/infiniband/sw/rxe/rxe_pool.c @@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool) kref_get(&pool->rxe->ref_cnt); - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { - atomic_dec(&pool->num_elem); - rxe_dev_put(pool->rxe); - rxe_pool_put(pool); - return NULL; - } + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) + goto out_put_pool; elem = kmem_cache_zalloc(pool_cache(pool), (pool->flags & RXE_POOL_ATOMIC) ? GFP_ATOMIC : GFP_KERNEL); if (!elem) - return NULL; + goto out_put_pool; elem->pool = pool; kref_init(&elem->ref_cnt); return elem; + +out_put_pool: + atomic_dec(&pool->num_elem); + rxe_dev_put(pool->rxe); + rxe_pool_put(pool); + return NULL; } void rxe_elem_release(struct kref *kref) -- Doug Ledford <dledford@redhat.com> GPG KeyID: B826A3330E572FDD Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD ^ permalink raw reply related [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem 2017-10-09 13:16 ` Doug Ledford @ 2017-10-09 13:18 ` Colin Ian King -1 siblings, 0 replies; 16+ messages in thread From: Colin Ian King @ 2017-10-09 13:18 UTC (permalink / raw) To: Doug Ledford, Leon Romanovsky Cc: Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel On 09/10/17 14:16, Doug Ledford wrote: > On Tue, 2017-09-12 at 17:48 +0300, Leon Romanovsky wrote: >> On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: >>> On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: >>>> From: Colin Ian King <colin.king@canonical.com> >>>> >>>> The allocation for elem may fail (especially because we're using >>>> GFP_ATOMIC) so best to check for a null return. This fixes a >>>> potential >>>> null pointer dereference when assigning elem->pool. >>>> >>>> Detected by CoverityScan CID#1357507 ("Dereference null return >>>> value") >>>> >>>> Fixes: 8700e3e7c485 ("Soft RoCE driver") >>>> Signed-off-by: Colin Ian King <colin.king@canonical.com> >>>> --- >>>> drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ >>>> 1 file changed, 2 insertions(+) >>>> >>>> diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c >>>> b/drivers/infiniband/sw/rxe/rxe_pool.c >>>> index c1b5f38f31a5..3b4916680018 100644 >>>> --- a/drivers/infiniband/sw/rxe/rxe_pool.c >>>> +++ b/drivers/infiniband/sw/rxe/rxe_pool.c >>>> @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) >>>> elem = kmem_cache_zalloc(pool_cache(pool), >>>> (pool->flags & RXE_POOL_ATOMIC) >>>> ? >>>> GFP_ATOMIC : GFP_KERNEL); >>>> + if (!elem) >>>> + return NULL; >>>> >>> >>> It is not enough to simply return NULL, you also should release >>> "pool" too. >> >> Colin, >> do you plan to fix the comment and resend it? > > Since Colin is non-responsive in this thread, I went ahead and took his > patch, but then applied a fixup of my own: Sorry, I somehow missed that email. Thanks for following this up. > > commit a79c0f939da23740c12f43019720055aade89367 (HEAD -> k.o/for-next) > Author: Doug Ledford <dledford@redhat.com> > Date: Mon Oct 9 09:11:32 2017 -0400 > > IB/rxe: put the pool on allocation failure > > If the allocation of elem fails, it is not sufficient to simply check > for NULL and return. We need to also put our reference on the pool or > else we will leave the pool with a permanent ref count and we will never > be able to free it. > > Fixes: 4831ca9e4a8e (IB/rxe: check for allocation failure on elem) > Suggested-by: Leon Romanovsky <leon@kernel.org> > Signed-off-by: Doug Ledford <dledford@redhat.com> > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index 3b4916680018..b4a8acc7bb7d 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool) > > kref_get(&pool->rxe->ref_cnt); > > - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { > - atomic_dec(&pool->num_elem); > - rxe_dev_put(pool->rxe); > - rxe_pool_put(pool); > - return NULL; > - } > + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) > + goto out_put_pool; > > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > if (!elem) > - return NULL; > + goto out_put_pool; > > elem->pool = pool; > kref_init(&elem->ref_cnt); > > return elem; > + > +out_put_pool: > + atomic_dec(&pool->num_elem); > + rxe_dev_put(pool->rxe); > + rxe_pool_put(pool); > + return NULL; > } > > void rxe_elem_release(struct kref *kref) > > ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-10-09 13:18 ` Colin Ian King 0 siblings, 0 replies; 16+ messages in thread From: Colin Ian King @ 2017-10-09 13:18 UTC (permalink / raw) To: Doug Ledford, Leon Romanovsky Cc: Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel On 09/10/17 14:16, Doug Ledford wrote: > On Tue, 2017-09-12 at 17:48 +0300, Leon Romanovsky wrote: >> On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: >>> On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: >>>> From: Colin Ian King <colin.king@canonical.com> >>>> >>>> The allocation for elem may fail (especially because we're using >>>> GFP_ATOMIC) so best to check for a null return. This fixes a >>>> potential >>>> null pointer dereference when assigning elem->pool. >>>> >>>> Detected by CoverityScan CID#1357507 ("Dereference null return >>>> value") >>>> >>>> Fixes: 8700e3e7c485 ("Soft RoCE driver") >>>> Signed-off-by: Colin Ian King <colin.king@canonical.com> >>>> --- >>>> drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ >>>> 1 file changed, 2 insertions(+) >>>> >>>> diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c >>>> b/drivers/infiniband/sw/rxe/rxe_pool.c >>>> index c1b5f38f31a5..3b4916680018 100644 >>>> --- a/drivers/infiniband/sw/rxe/rxe_pool.c >>>> +++ b/drivers/infiniband/sw/rxe/rxe_pool.c >>>> @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) >>>> elem = kmem_cache_zalloc(pool_cache(pool), >>>> (pool->flags & RXE_POOL_ATOMIC) >>>> ? >>>> GFP_ATOMIC : GFP_KERNEL); >>>> + if (!elem) >>>> + return NULL; >>>> >>> >>> It is not enough to simply return NULL, you also should release >>> "pool" too. >> >> Colin, >> do you plan to fix the comment and resend it? > > Since Colin is non-responsive in this thread, I went ahead and took his > patch, but then applied a fixup of my own: Sorry, I somehow missed that email. Thanks for following this up. > > commit a79c0f939da23740c12f43019720055aade89367 (HEAD -> k.o/for-next) > Author: Doug Ledford <dledford@redhat.com> > Date: Mon Oct 9 09:11:32 2017 -0400 > > IB/rxe: put the pool on allocation failure > > If the allocation of elem fails, it is not sufficient to simply check > for NULL and return. We need to also put our reference on the pool or > else we will leave the pool with a permanent ref count and we will never > be able to free it. > > Fixes: 4831ca9e4a8e (IB/rxe: check for allocation failure on elem) > Suggested-by: Leon Romanovsky <leon@kernel.org> > Signed-off-by: Doug Ledford <dledford@redhat.com> > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index 3b4916680018..b4a8acc7bb7d 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool) > > kref_get(&pool->rxe->ref_cnt); > > - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { > - atomic_dec(&pool->num_elem); > - rxe_dev_put(pool->rxe); > - rxe_pool_put(pool); > - return NULL; > - } > + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) > + goto out_put_pool; > > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > if (!elem) > - return NULL; > + goto out_put_pool; > > elem->pool = pool; > kref_init(&elem->ref_cnt); > > return elem; > + > +out_put_pool: > + atomic_dec(&pool->num_elem); > + rxe_dev_put(pool->rxe); > + rxe_pool_put(pool); > + return NULL; > } > > void rxe_elem_release(struct kref *kref) > > ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem 2017-10-09 13:18 ` Colin Ian King @ 2017-10-09 16:13 ` Doug Ledford -1 siblings, 0 replies; 16+ messages in thread From: Doug Ledford @ 2017-10-09 16:13 UTC (permalink / raw) To: Colin Ian King, Leon Romanovsky Cc: Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel On Mon, 2017-10-09 at 14:18 +0100, Colin Ian King wrote: > On 09/10/17 14:16, Doug Ledford wrote: > > > > > > Since Colin is non-responsive in this thread, I went ahead and took > > his > > patch, but then applied a fixup of my own: > > Sorry, I somehow missed that email. Thanks for following this up. No worries. You're normally responsive, so that's why I said "in this thread" and just took care of. -- Doug Ledford <dledford@redhat.com> GPG KeyID: B826A3330E572FDD Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-10-09 16:13 ` Doug Ledford 0 siblings, 0 replies; 16+ messages in thread From: Doug Ledford @ 2017-10-09 16:13 UTC (permalink / raw) To: Colin Ian King, Leon Romanovsky Cc: Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel On Mon, 2017-10-09 at 14:18 +0100, Colin Ian King wrote: > On 09/10/17 14:16, Doug Ledford wrote: > > > > > > Since Colin is non-responsive in this thread, I went ahead and took > > his > > patch, but then applied a fixup of my own: > > Sorry, I somehow missed that email. Thanks for following this up. No worries. You're normally responsive, so that's why I said "in this thread" and just took care of. -- Doug Ledford <dledford@redhat.com> GPG KeyID: B826A3330E572FDD Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD ^ permalink raw reply [flat|nested] 16+ messages in thread
[parent not found: <1507554995.46071.25.camel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>]
* Re: [PATCH] IB/rxe: check for allocation failure on elem [not found] ` <1507554995.46071.25.camel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> 2017-10-09 13:43 ` Leon Romanovsky @ 2017-10-09 13:43 ` Leon Romanovsky 0 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-10-09 13:43 UTC (permalink / raw) To: Doug Ledford Cc: Colin King, Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma-u79uwXL29TY76Z2rM5mHXA, kernel-janitors-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA [-- Attachment #1: Type: text/plain, Size: 3789 bytes --] On Mon, Oct 09, 2017 at 09:16:35AM -0400, Doug Ledford wrote: > On Tue, 2017-09-12 at 17:48 +0300, Leon Romanovsky wrote: > > On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: > > > On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > > > > From: Colin Ian King <colin.king@canonical.com> > > > > > > > > The allocation for elem may fail (especially because we're using > > > > GFP_ATOMIC) so best to check for a null return. This fixes a > > > > potential > > > > null pointer dereference when assigning elem->pool. > > > > > > > > Detected by CoverityScan CID#1357507 ("Dereference null return > > > > value") > > > > > > > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > > > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > > > > --- > > > > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > > > > 1 file changed, 2 insertions(+) > > > > > > > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c > > > > b/drivers/infiniband/sw/rxe/rxe_pool.c > > > > index c1b5f38f31a5..3b4916680018 100644 > > > > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > > > > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > > > > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > > > > elem = kmem_cache_zalloc(pool_cache(pool), > > > > (pool->flags & RXE_POOL_ATOMIC) > > > > ? > > > > GFP_ATOMIC : GFP_KERNEL); > > > > + if (!elem) > > > > + return NULL; > > > > > > > > > > It is not enough to simply return NULL, you also should release > > > "pool" too. > > > > Colin, > > do you plan to fix the comment and resend it? > > Since Colin is non-responsive in this thread, I went ahead and took his > patch, but then applied a fixup of my own: > > commit a79c0f939da23740c12f43019720055aade89367 (HEAD -> k.o/for-next) > Author: Doug Ledford <dledford@redhat.com> > Date: Mon Oct 9 09:11:32 2017 -0400 > > IB/rxe: put the pool on allocation failure > > If the allocation of elem fails, it is not sufficient to simply check > for NULL and return. We need to also put our reference on the pool or > else we will leave the pool with a permanent ref count and we will never > be able to free it. > > Fixes: 4831ca9e4a8e (IB/rxe: check for allocation failure on elem) You forgot to add double quotes in fixes line. Thanks > Suggested-by: Leon Romanovsky <leon@kernel.org> > Signed-off-by: Doug Ledford <dledford@redhat.com> > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index 3b4916680018..b4a8acc7bb7d 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool) > > kref_get(&pool->rxe->ref_cnt); > > - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { > - atomic_dec(&pool->num_elem); > - rxe_dev_put(pool->rxe); > - rxe_pool_put(pool); > - return NULL; > - } > + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) > + goto out_put_pool; > > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > if (!elem) > - return NULL; > + goto out_put_pool; > > elem->pool = pool; > kref_init(&elem->ref_cnt); > > return elem; > + > +out_put_pool: > + atomic_dec(&pool->num_elem); > + rxe_dev_put(pool->rxe); > + rxe_pool_put(pool); > + return NULL; > } > > void rxe_elem_release(struct kref *kref) > > > -- > Doug Ledford <dledford@redhat.com> > GPG KeyID: B826A3330E572FDD > Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-10-09 13:43 ` Leon Romanovsky 0 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-10-09 13:43 UTC (permalink / raw) To: Doug Ledford Cc: Colin King, Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma, kernel-janitors, linux-kernel [-- Attachment #1: Type: text/plain, Size: 3789 bytes --] On Mon, Oct 09, 2017 at 09:16:35AM -0400, Doug Ledford wrote: > On Tue, 2017-09-12 at 17:48 +0300, Leon Romanovsky wrote: > > On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: > > > On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > > > > From: Colin Ian King <colin.king@canonical.com> > > > > > > > > The allocation for elem may fail (especially because we're using > > > > GFP_ATOMIC) so best to check for a null return. This fixes a > > > > potential > > > > null pointer dereference when assigning elem->pool. > > > > > > > > Detected by CoverityScan CID#1357507 ("Dereference null return > > > > value") > > > > > > > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > > > > Signed-off-by: Colin Ian King <colin.king@canonical.com> > > > > --- > > > > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > > > > 1 file changed, 2 insertions(+) > > > > > > > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c > > > > b/drivers/infiniband/sw/rxe/rxe_pool.c > > > > index c1b5f38f31a5..3b4916680018 100644 > > > > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > > > > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > > > > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > > > > elem = kmem_cache_zalloc(pool_cache(pool), > > > > (pool->flags & RXE_POOL_ATOMIC) > > > > ? > > > > GFP_ATOMIC : GFP_KERNEL); > > > > + if (!elem) > > > > + return NULL; > > > > > > > > > > It is not enough to simply return NULL, you also should release > > > "pool" too. > > > > Colin, > > do you plan to fix the comment and resend it? > > Since Colin is non-responsive in this thread, I went ahead and took his > patch, but then applied a fixup of my own: > > commit a79c0f939da23740c12f43019720055aade89367 (HEAD -> k.o/for-next) > Author: Doug Ledford <dledford@redhat.com> > Date: Mon Oct 9 09:11:32 2017 -0400 > > IB/rxe: put the pool on allocation failure > > If the allocation of elem fails, it is not sufficient to simply check > for NULL and return. We need to also put our reference on the pool or > else we will leave the pool with a permanent ref count and we will never > be able to free it. > > Fixes: 4831ca9e4a8e (IB/rxe: check for allocation failure on elem) You forgot to add double quotes in fixes line. Thanks > Suggested-by: Leon Romanovsky <leon@kernel.org> > Signed-off-by: Doug Ledford <dledford@redhat.com> > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index 3b4916680018..b4a8acc7bb7d 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool) > > kref_get(&pool->rxe->ref_cnt); > > - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { > - atomic_dec(&pool->num_elem); > - rxe_dev_put(pool->rxe); > - rxe_pool_put(pool); > - return NULL; > - } > + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) > + goto out_put_pool; > > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > if (!elem) > - return NULL; > + goto out_put_pool; > > elem->pool = pool; > kref_init(&elem->ref_cnt); > > return elem; > + > +out_put_pool: > + atomic_dec(&pool->num_elem); > + rxe_dev_put(pool->rxe); > + rxe_pool_put(pool); > + return NULL; > } > > void rxe_elem_release(struct kref *kref) > > > -- > Doug Ledford <dledford@redhat.com> > GPG KeyID: B826A3330E572FDD > Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH] IB/rxe: check for allocation failure on elem @ 2017-10-09 13:43 ` Leon Romanovsky 0 siblings, 0 replies; 16+ messages in thread From: Leon Romanovsky @ 2017-10-09 13:43 UTC (permalink / raw) To: Doug Ledford Cc: Colin King, Moni Shoua, Sean Hefty, Hal Rosenstock, linux-rdma-u79uwXL29TY76Z2rM5mHXA, kernel-janitors-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA [-- Attachment #1: Type: text/plain, Size: 3957 bytes --] On Mon, Oct 09, 2017 at 09:16:35AM -0400, Doug Ledford wrote: > On Tue, 2017-09-12 at 17:48 +0300, Leon Romanovsky wrote: > > On Sat, Sep 09, 2017 at 03:56:07PM +0300, Leon Romanovsky wrote: > > > On Fri, Sep 08, 2017 at 03:37:45PM +0100, Colin King wrote: > > > > From: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > > > > > > > > The allocation for elem may fail (especially because we're using > > > > GFP_ATOMIC) so best to check for a null return. This fixes a > > > > potential > > > > null pointer dereference when assigning elem->pool. > > > > > > > > Detected by CoverityScan CID#1357507 ("Dereference null return > > > > value") > > > > > > > > Fixes: 8700e3e7c485 ("Soft RoCE driver") > > > > Signed-off-by: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > > > > --- > > > > drivers/infiniband/sw/rxe/rxe_pool.c | 2 ++ > > > > 1 file changed, 2 insertions(+) > > > > > > > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c > > > > b/drivers/infiniband/sw/rxe/rxe_pool.c > > > > index c1b5f38f31a5..3b4916680018 100644 > > > > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > > > > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > > > > @@ -404,6 +404,8 @@ void *rxe_alloc(struct rxe_pool *pool) > > > > elem = kmem_cache_zalloc(pool_cache(pool), > > > > (pool->flags & RXE_POOL_ATOMIC) > > > > ? > > > > GFP_ATOMIC : GFP_KERNEL); > > > > + if (!elem) > > > > + return NULL; > > > > > > > > > > It is not enough to simply return NULL, you also should release > > > "pool" too. > > > > Colin, > > do you plan to fix the comment and resend it? > > Since Colin is non-responsive in this thread, I went ahead and took his > patch, but then applied a fixup of my own: > > commit a79c0f939da23740c12f43019720055aade89367 (HEAD -> k.o/for-next) > Author: Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> > Date: Mon Oct 9 09:11:32 2017 -0400 > > IB/rxe: put the pool on allocation failure > > If the allocation of elem fails, it is not sufficient to simply check > for NULL and return. We need to also put our reference on the pool or > else we will leave the pool with a permanent ref count and we will never > be able to free it. > > Fixes: 4831ca9e4a8e (IB/rxe: check for allocation failure on elem) You forgot to add double quotes in fixes line. Thanks > Suggested-by: Leon Romanovsky <leon-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org> > Signed-off-by: Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> > > diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c > index 3b4916680018..b4a8acc7bb7d 100644 > --- a/drivers/infiniband/sw/rxe/rxe_pool.c > +++ b/drivers/infiniband/sw/rxe/rxe_pool.c > @@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool) > > kref_get(&pool->rxe->ref_cnt); > > - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { > - atomic_dec(&pool->num_elem); > - rxe_dev_put(pool->rxe); > - rxe_pool_put(pool); > - return NULL; > - } > + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) > + goto out_put_pool; > > elem = kmem_cache_zalloc(pool_cache(pool), > (pool->flags & RXE_POOL_ATOMIC) ? > GFP_ATOMIC : GFP_KERNEL); > if (!elem) > - return NULL; > + goto out_put_pool; > > elem->pool = pool; > kref_init(&elem->ref_cnt); > > return elem; > + > +out_put_pool: > + atomic_dec(&pool->num_elem); > + rxe_dev_put(pool->rxe); > + rxe_pool_put(pool); > + return NULL; > } > > void rxe_elem_release(struct kref *kref) > > > -- > Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> > GPG KeyID: B826A3330E572FDD > Key fingerprint = AE6B 1BDA 122B 23B4 265B 1274 B826 A333 0E57 2FDD > [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2017-10-09 16:13 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-09-08 14:37 [PATCH] IB/rxe: check for allocation failure on elem Colin King
2017-09-08 14:37 ` Colin King
[not found] ` <20170908143745.2445-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
2017-09-09 12:56 ` Leon Romanovsky
2017-09-09 12:56 ` Leon Romanovsky
2017-09-09 12:56 ` Leon Romanovsky
2017-09-12 14:48 ` Leon Romanovsky
2017-09-12 14:48 ` Leon Romanovsky
2017-10-09 13:16 ` Doug Ledford
2017-10-09 13:16 ` Doug Ledford
2017-10-09 13:18 ` Colin Ian King
2017-10-09 13:18 ` Colin Ian King
2017-10-09 16:13 ` Doug Ledford
2017-10-09 16:13 ` Doug Ledford
[not found] ` <1507554995.46071.25.camel-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2017-10-09 13:43 ` Leon Romanovsky
2017-10-09 13:43 ` Leon Romanovsky
2017-10-09 13:43 ` Leon Romanovsky
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.