Skip to contentSkip to conversation

NVMe: Prevent possible NULL pointer dereference

PATCH New Santosh Y 3 participants 3 messages May 29, 2014 – Jun 2, 2014

Subsystems (2)
Block layer NVMe
lore
Share & tools
lore

Santosh Y

author
#0 lore raw

PATCH 1/1 NVMe: Prevent possible NULL pointer dereference

kmalloc() used by the nvme_alloc_iod() to allocate memory for 'iod' can fail. So check the return value.

Signed-off-by Santosh Y <santosh.sy at samsung.com>
drivers/block/nvme-core.c +4 -1
index cd8a8bc7..b089459 100644
@@ -1488,7 +1488,11 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
 		goto put_pages;
 	}
 
+	err = -ENOMEM;
 	iod = nvme_alloc_iod(count, length, GFP_KERNEL);
+	if (!iod)
+		goto put_pages;
+
 	sg = iod->sg;
 	sg_init_table(sg, count);
 	for (i = 0; i < count; i++) {

@@ -1501,7 +1505,6 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
 	sg_mark_end(&sg[i - 1]);
 	iod->nents = count;
 
-	err = -ENOMEM;
 	nents = dma_map_sg(&dev->pci_dev->dev, sg, count,
 				write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 	if (!nents)
Signature · 1 line
1.8.3.2
#1 lore raw

PATCH 1/1 NVMe: Prevent possible NULL pointer dereference

Quoted 22 lines · Santosh Y

kmalloc() used by the nvme_alloc_iod() to allocate memory for 'iod' can fail. So check the return value.

Signed-off-by Santosh Y <santosh.sy at samsung.com>
drivers/block/nvme-core.c +4 -0
index cd8a8bc7..b089459 100644
@@ -1488,7 +1488,11 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
  		goto put_pages;
  	}
 
+	err = -ENOMEM;
  	iod = nvme_alloc_iod(count, length, GFP_KERNEL);
+	if (!iod)
+		goto put_pages;
+
  	sg = iod->sg;
  	sg_init_table(sg, count);
  	for (i = 0; i < count; i++) {

drivers/block/nvme-core.c struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write, · line 1504

Quoted 4 lines
drivers/block/nvme-core.c +0 -1
@@ -1501,7 +1505,6 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write,
  	sg_mark_end(&sg[i - 1]);
  	iod->nents = count;
 
-	err = -ENOMEM;

I am not that familiar with this nvme code yet, but should this statement be left in? It looks to me that this 'err = -ENOMEM;' assignment is for the case if dma_map_sg() statement below it fails.

Quoted 4 lines
drivers/block/nvme-core.c +0 -0
  	nents = dma_map_sg(&dev->pci_dev->dev, sg, count,
  				write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
  	if (!nents)
#2 lore raw

PATCH 1/1 NVMe: Prevent possible NULL pointer dereference

Quoted 28 lines · J Freyensee
Quoted 27 lines · Santosh Y

kmalloc() used by the nvme_alloc_iod() to allocate memory for 'iod' can fail. So check the return value.

Signed-off-by Santosh Y <santosh.sy at samsung.com>
drivers/block/nvme-core.c +4 -0
index cd8a8bc7..b089459 100644
@@ -1488,7 +1488,11 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev 
 *dev, int write,
  		goto put_pages;
  	}
 
+	err = -ENOMEM;
  	iod = nvme_alloc_iod(count, length, GFP_KERNEL);
+	if (!iod)
+		goto put_pages;
+
  	sg = iod->sg;
  	sg_init_table(sg, count);

  	for (i = 0; i < count; i++) {
drivers/block/nvme-core.c +0 -0
@@ -1501,7 +1505,6 @@ struct nvme_iod *nvme_map_user_pages(struct nvme_dev 
 *dev, int write,
  	sg_mark_end(&sg[i - 1]);
  	iod->nents = count;
Quoted 5 lines

drivers/block/nvme-core.c struct nvme_iod *nvme_map_user_pages(struct nvme_dev *dev, int write, · line 1504

Quoted 1 line
drivers/block/nvme-core.c +0 -1
-	err = -ENOMEM;

I am not that familiar with this nvme code yet, but should this statement be left in? It looks to me that this 'err = -ENOMEM;' assignment is for the case if dma_map_sg() statement below it fails.

This is not being removed in the patch. It's just moved up higher in the function.