From mboxrd@z Thu Jan  1 00:00:00 1970
From: David Miller <davem@davemloft.net>
Subject: Re: [net-next 1/4] tipc: replace name table service range array
 with rb tree
Date: Thu, 29 Mar 2018 14:46:42 -0400 (EDT)
Message-ID: <20180329.144642.751836841871954960.davem@davemloft.net>
References: <1522249103-32714-1-git-send-email-jon.maloy@ericsson.com>
        <1522249103-32714-2-git-send-email-jon.maloy@ericsson.com>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: netdev@vger.kernel.org,
        mohan.krishna.ghanta.krishnamurthy@ericsson.com,
        tung.q.nguyen@dektech.com.au, hoang.h.le@dektech.com.au,
        canh.d.luu@dektech.com.au, ying.xue@windriver.com,
        tipc-discussion@lists.sourceforge.net
To: jon.maloy@ericsson.com
Return-path: <netdev-owner@vger.kernel.org>
Received: from shards.monkeyblade.net ([184.105.139.130]:48082 "EHLO
        shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751195AbeC2Sqo (ORCPT
        <rfc822;netdev@vger.kernel.org>); Thu, 29 Mar 2018 14:46:44 -0400
In-Reply-To: <1522249103-32714-2-git-send-email-jon.maloy@ericsson.com>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

From: Jon Maloy <jon.maloy@ericsson.com>
Date: Wed, 28 Mar 2018 16:58:20 +0200

> -/*
> - * tipc_nametbl_publish - add name publication to network name tables
> +/* tipc_nametbl_publish - add service binding to name table
>   */
>  struct publication *tipc_nametbl_publish(struct net *net, u32 type, u32 lower,
> -					 u32 upper, u32 scope, u32 port_ref,
> +					 u32 upper, u32 scope, u32 port,
>  					 u32 key)
>  {
> -	struct publication *publ;
> -	struct sk_buff *buf = NULL;
> -	struct tipc_net *tn = net_generic(net, tipc_net_id);
> +	struct name_table *nt = tipc_name_table(net);
> +	struct tipc_net *tn = tipc_net(net);
> +	struct sk_buff *skb = NULL;
> +	struct publication *p;
>  
>  	spin_lock_bh(&tn->nametbl_lock);
> -	if (tn->nametbl->local_publ_count >= TIPC_MAX_PUBLICATIONS) {
> -		pr_warn("Publication failed, local publication limit reached (%u)\n",
> -			TIPC_MAX_PUBLICATIONS);
> -		spin_unlock_bh(&tn->nametbl_lock);
> -		return NULL;
> +
> +	if (nt->local_publ_count >= TIPC_MAX_PUBL) {
> +		pr_warn("Bind failed, max limit %u reached\n", TIPC_MAX_PUBL);
> +		goto exit;

If we goto exit:...

> +exit:
>  	spin_unlock_bh(&tn->nametbl_lock);
>  
> -	if (buf)
> -		tipc_node_broadcast(net, buf);
> -	return publ;
> +	if (skb)
> +		tipc_node_broadcast(net, skb);
> +	return p;
>  }

'p' is uninitialized, yet we return it.