[bug report] rdma/siw: queue pair methods

From: Dan Carpenter <dan.carpenter@oracle.com>
To: bmt@zurich.ibm.com
Cc: linux-rdma@vger.kernel.org
Subject: [bug report] rdma/siw: queue pair methods
Date: Fri, 26 Jul 2019 11:10:56 +0300	[thread overview]
Message-ID: <20190726081056.GA27059@mwanda> (raw)

Hello Bernard Metzler,

The patch f29dd55b0236: "rdma/siw: queue pair methods" from Jun 20,
2019, leads to the following static checker warning:

	drivers/infiniband/sw/siw/siw_qp.c:226 siw_qp_enable_crc()
	warn: variable dereferenced before check 'siw_crypto_shash' (see line 223)

drivers/infiniband/sw/siw/siw_qp.c
   219  static int siw_qp_enable_crc(struct siw_qp *qp)
   220  {
   221          struct siw_rx_stream *c_rx = &qp->rx_stream;
   222          struct siw_iwarp_tx *c_tx = &qp->tx_ctx;
   223          int size = crypto_shash_descsize(siw_crypto_shash) +
                                                 ^^^^^^^^^^^^^^^^
Dereferenced inside function.

   224                          sizeof(struct shash_desc);
   225  
   226          if (siw_crypto_shash == NULL)
                    ^^^^^^^^^^^^^^^^^^^^^^^^
Checked too late.

   227                  return -ENOENT;
   228  
   229          c_tx->mpa_crc_hd = kzalloc(size, GFP_KERNEL);
   230          c_rx->mpa_crc_hd = kzalloc(size, GFP_KERNEL);
   231          if (!c_tx->mpa_crc_hd || !c_rx->mpa_crc_hd) {
   232                  kfree(c_tx->mpa_crc_hd);
   233                  kfree(c_rx->mpa_crc_hd);
   234                  c_tx->mpa_crc_hd = NULL;
   235                  c_rx->mpa_crc_hd = NULL;
   236                  return -ENOMEM;
   237          }
   238          c_tx->mpa_crc_hd->tfm = siw_crypto_shash;
   239          c_rx->mpa_crc_hd->tfm = siw_crypto_shash;
   240  
   241          return 0;
   242  }

regards,
dan carpenter