netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Leon Romanovsky <leon@kernel.org>
To: Doug Ledford <dledford@redhat.com>, Jason Gunthorpe <jgg@mellanox.com>
Cc: Leon Romanovsky <leonro@mellanox.com>,
	RDMA mailing list <linux-rdma@vger.kernel.org>,
	Hadar Hen Zion <hadarh@mellanox.com>,
	Matan Barak <matanb@mellanox.com>,
	Michael J Ruhl <michael.j.ruhl@intel.com>,
	Noa Osherovich <noaos@mellanox.com>,
	Raed Salem <raeds@mellanox.com>,
	Yishai Hadas <yishaih@mellanox.com>,
	Saeed Mahameed <saeedm@mellanox.com>,
	linux-netdev <netdev@vger.kernel.org>
Subject: [PATCH rdma-next 06/12] RDMA/uverbs: Don't overwrite NULL pointer with ZERO_SIZE_PTR
Date: Sun, 24 Jun 2018 11:23:47 +0300	[thread overview]
Message-ID: <20180624082353.16138-7-leon@kernel.org> (raw)
In-Reply-To: <20180624082353.16138-1-leon@kernel.org>

From: Leon Romanovsky <leonro@mellanox.com>

Number of specs is provided by user and in valid case can be equal to zero.
Such argument causes to call to kcalloc() with zero-length request and in
return the ZERO_SIZE_PTR is assigned. This pointer is different from NULL
and makes various if (..) checks to success.

Fixes: b6ba4a9aa59f ("IB/uverbs: Add support for flow counters")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
---
 drivers/infiniband/core/uverbs_cmd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 3aba63aa1779..8ed4b674416f 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2768,6 +2768,9 @@ static struct ib_uflow_resources *flow_resources_alloc(size_t num_specs)
 	if (!resources)
 		return NULL;
 
+	if (!num_specs)
+		goto out;
+
 	resources->counters =
 		kcalloc(num_specs, sizeof(*resources->counters), GFP_KERNEL);
 	resources->collection =
@@ -2776,8 +2779,8 @@ static struct ib_uflow_resources *flow_resources_alloc(size_t num_specs)
 	if (!resources->counters || !resources->collection)
 		goto err;
 
+out:
 	resources->max = num_specs;
-
 	return resources;
 
 err:
-- 
2.14.4

  parent reply	other threads:[~2018-06-24  8:24 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-24  8:23 [PATCH rdma-next 00/12] RDMA fixes 2018-06-24 Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 01/12] RDMA/uverbs: Protect from attempts to create flows on unsupported QP Leon Romanovsky
2018-06-25 21:14   ` Jason Gunthorpe
2018-06-24  8:23 ` [PATCH rdma-next 02/12] RDMA/uverbs: Check existence of create_flow callback Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 03/12] RDMA/verbs: Drop kernel variant of create_flow Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 04/12] RDMA/verbs: Drop kernel variant of destroy_flow Leon Romanovsky
2018-06-24  8:23 ` [PATCH mlx5-next 05/12] net/mlx5: Rate limit errors in command interface Leon Romanovsky
2018-06-27  5:48   ` Leon Romanovsky
2018-06-24  8:23 ` Leon Romanovsky [this message]
2018-06-24 19:57   ` [PATCH rdma-next 06/12] RDMA/uverbs: Don't overwrite NULL pointer with ZERO_SIZE_PTR Jason Gunthorpe
2018-06-25  8:08     ` Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 07/12] RDMA/umem: Don't check for negative return value of dma_map_sg_attrs() Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 08/12] overflow.h: Add arithmetic shift helper Leon Romanovsky
     [not found]   ` <CAKwiHFhgsyWYD+q+JFb2HJEphnjiiOp=o4Airv3MW031q2jx8w@mail.gmail.com>
2018-06-25 17:11     ` Jason Gunthorpe
2018-06-26  4:16       ` Leon Romanovsky
     [not found]       ` <CAKwiHFiRYbyiJqDYCgKXKZYRr0KjCt8q9AwKwfqoCA1sT2KFyQ@mail.gmail.com>
2018-06-26 11:37         ` Leon Romanovsky
2018-06-26 17:54         ` Jason Gunthorpe
     [not found]           ` <CAKwiHFgchr+6HYOZ4e4e1vzL9cFabe6eonNNM8NTWZypazcuKA@mail.gmail.com>
2018-06-27 17:39             ` Leon Romanovsky
2018-06-27 18:10             ` Jason Gunthorpe
2018-06-27 18:22               ` Leon Romanovsky
2018-06-27 21:35                 ` Rasmus Villemoes
2018-06-27 18:44               ` Kees Cook
2018-08-01  9:36           ` Peter Zijlstra
2018-08-01 16:14             ` Jason Gunthorpe
2018-06-26  4:24     ` Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 09/12] RDMA/mlx5: Fix shift overflow in mlx5_ib_create_wq Leon Romanovsky
2018-06-24 19:56   ` Jason Gunthorpe
2018-06-25  8:10     ` Leon Romanovsky
2018-06-25 14:58       ` Jason Gunthorpe
2018-06-24  8:23 ` [PATCH rdma-next 10/12] RDMA/mlx5: Reuse existed shift_overlow helper Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 11/12] RDMA/uverbs: Remove redundant check Leon Romanovsky
2018-06-24  8:23 ` [PATCH rdma-next 12/12] RDMA/uverbs: Fix slab-out-of-bounds in ib_uverbs_ex_create_flow Leon Romanovsky
2018-06-25 21:34 ` [PATCH rdma-next 00/12] RDMA fixes 2018-06-24 Jason Gunthorpe
2018-06-26  4:21   ` Leon Romanovsky
2018-06-26 20:39     ` Jason Gunthorpe
2018-06-27  5:47       ` Leon Romanovsky

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180624082353.16138-7-leon@kernel.org \
    --to=leon@kernel.org \
    --cc=dledford@redhat.com \
    --cc=hadarh@mellanox.com \
    --cc=jgg@mellanox.com \
    --cc=leonro@mellanox.com \
    --cc=linux-rdma@vger.kernel.org \
    --cc=matanb@mellanox.com \
    --cc=michael.j.ruhl@intel.com \
    --cc=netdev@vger.kernel.org \
    --cc=noaos@mellanox.com \
    --cc=raeds@mellanox.com \
    --cc=saeedm@mellanox.com \
    --cc=yishaih@mellanox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).