From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr710102.outbound.protection.outlook.com ([40.107.71.102]:64704 "EHLO NAM05-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728756AbeIQI15 (ORCPT ); Mon, 17 Sep 2018 04:27:57 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH AUTOSEL 4.18 098/136] RDMA/uverbs: Don't overwrite NULL pointer with ZERO_SIZE_PTR Date: Mon, 17 Sep 2018 03:01:13 +0000 Message-ID: <20180917030006.245495-98-alexander.levin@microsoft.com> References: <20180917030006.245495-1-alexander.levin@microsoft.com> In-Reply-To: <20180917030006.245495-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Leon Romanovsky [ Upstream commit a5cc9831af05e658543593abaee45a29d061bac4 ] Number of specs is provided by user and in valid case can be equal to zero. Such argument causes to call to kcalloc() with zero-length request and in return the ZERO_SIZE_PTR is assigned. This pointer is different from NULL and makes various if (..) checks to success. Fixes: b6ba4a9aa59f ("IB/uverbs: Add support for flow counters") Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin --- drivers/infiniband/core/uverbs_cmd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core= /uverbs_cmd.c index 583d3a10b940..0e5eb0f547d3 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -2812,6 +2812,9 @@ static struct ib_uflow_resources *flow_resources_allo= c(size_t num_specs) if (!resources) goto err_res; =20 + if (!num_specs) + goto out; + resources->counters =3D kcalloc(num_specs, sizeof(*resources->counters), GFP_KERNEL); =20 @@ -2824,8 +2827,8 @@ static struct ib_uflow_resources *flow_resources_allo= c(size_t num_specs) if (!resources->collection) goto err_collection; =20 +out: resources->max =3D num_specs; - return resources; =20 err_collection: --=20 2.17.1