New: cxgb4: unchecked return value of alloc_skb() in function send_fw_pass_open_req()

https://bugzilla.kernel.org/show_bug.cgi?id=195511

            Bug ID: 195511
           Summary: cxgb4: unchecked return value of alloc_skb() in
                    function send_fw_pass_open_req()
           Product: Drivers
           Version: 2.5
    Kernel Version: linux-4.11-rc7
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Infiniband/RDMA
          Assignee: drivers_infiniband-rdma-ztI5WcYan/[email protected]
          Reporter: [email protected]
        Regression: No

Function alloc_skb() will return a NULL pointer when there is no enough memory. However, the return value of alloc_skb() is directly used without validation in function send_fw_pass_open_req() (see lines 3802~3804). The related code snippets are shown as follows.
send_fw_pass_open_req @@ drivers/infiniband/hw/cxgb4/cm.c:
3791 static void send_fw_pass_open_req(struct c4iw_dev *dev, struct sk_buff *skb,

3792                   __be32 laddr, __be16 lport,
3793                   __be32 raddr, __be16 rport,
3794                   u32 rcv_isn, u32 filter, u16 window,
3795                   u32 rss_qid, u8 port_id)
3796 {
3797     struct sk_buff *req_skb;
3798     struct fw_ofld_connection_wr *req;
3799     struct cpl_pass_accept_req *cpl = cplhdr(skb);
3800     int ret;

3801
3802 req_skb = alloc_skb(sizeof(struct fw_ofld_connection_wr), GFP_KERNEL);
3803 req = (struct fw_ofld_connection_wr *)__skb_put(req_skb,
sizeof(*req));

3804     memset(req, 0, sizeof(*req));
         ...

3844 }

Generally, the return value of alloc_skb() should be checked against NULL, as follows.
rfcomm_queue_disc @@ net/bluetooth/rfcomm/core.c: 855
855 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
856 {
857 struct rfcomm_cmd *cmd;
858 struct sk_buff *skb;
859
860 BT_DBG("dlc %p dlci %d", d, d->dlci);
861
862 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
863 if (!skb)
864 return -ENOMEM;
865

 866     cmd = (void *) __skb_put(skb, sizeof(*cmd));
 867     cmd->addr = d->addr;
 868     cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 869     cmd->len  = __len8(0);
 870     cmd->fcs  = __fcs2((u8 *) cmd);
 871 
 872     skb_queue_tail(&d->tx_queue, skb);
 873     rfcomm_schedule();
 874     return 0;

875 }

Thanks very much for your attention!

Pan Bian

You are receiving this mail because:
You are watching the assignee of the bug.--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html