From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [PATCH] 9p: potential NULL dereference Date: Wed, 26 Sep 2018 13:39:34 +0300 Message-ID: <20180926103934.GA14535@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Latchesar Ionkov , Dominique Martinet , "David S. Miller" , v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org, kernel-janitors@vger.kernel.org To: Eric Van Hensbergen , Matthew Wilcox Return-path: Received: from aserp2120.oracle.com ([141.146.126.78]:39630 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726841AbeIZQwo (ORCPT ); Wed, 26 Sep 2018 12:52:44 -0400 Content-Disposition: inline Sender: netdev-owner@vger.kernel.org List-ID: p9_tag_alloc() is supposed to return error pointers, but we accidentally return a NULL here. It would cause a NULL dereference in the caller. Fixes: 996d5b4db4b1 ("9p: Use a slab for allocating requests") Signed-off-by: Dan Carpenter diff --git a/net/9p/client.c b/net/9p/client.c index 47fa6158a75a..5f23e18eecc0 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -281,7 +281,7 @@ p9_tag_alloc(struct p9_client *c, int8_t type, unsigned int max_size) int tag; if (!req) - return NULL; + return ERR_PTR(-ENOMEM); if (p9_fcall_init(c, &req->tc, alloc_msize)) goto free_req; From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Wed, 26 Sep 2018 10:39:34 +0000 Subject: [PATCH] 9p: potential NULL dereference Message-Id: <20180926103934.GA14535@mwanda> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Eric Van Hensbergen , Matthew Wilcox Cc: Latchesar Ionkov , Dominique Martinet , "David S. Miller" , v9fs-developer@lists.sourceforge.net, netdev@vger.kernel.org, kernel-janitors@vger.kernel.org p9_tag_alloc() is supposed to return error pointers, but we accidentally return a NULL here. It would cause a NULL dereference in the caller. Fixes: 996d5b4db4b1 ("9p: Use a slab for allocating requests") Signed-off-by: Dan Carpenter diff --git a/net/9p/client.c b/net/9p/client.c index 47fa6158a75a..5f23e18eecc0 100644 --- a/net/9p/client.c +++ b/net/9p/client.c @@ -281,7 +281,7 @@ p9_tag_alloc(struct p9_client *c, int8_t type, unsigned int max_size) int tag; if (!req) - return NULL; + return ERR_PTR(-ENOMEM); if (p9_fcall_init(c, &req->tc, alloc_msize)) goto free_req;