diff mbox series

[-next] IB/uverbs: fix an potential error pointer dereference

Message ID 20230804022525.1916766-1-xiangyang3@huawei.com (mailing list archive)
State Accepted
Headers show
Series [-next] IB/uverbs: fix an potential error pointer dereference | expand

Commit Message

Xiang Yang Aug. 4, 2023, 2:25 a.m. UTC
Smatch reports the warning below:
drivers/infiniband/core/uverbs_std_types_counters.c:110
ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ() error: 'uattr'
dereferencing possible ERR_PTR()

the return value of uattr maybe ERR_PTR(-ENOENT), fix this by checking
the value of uattr before using it.

Fixes: ebb6796bd397 ("IB/uverbs: Add read counters support")
Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
---
 drivers/infiniband/core/uverbs_std_types_counters.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Leon Romanovsky Aug. 7, 2023, 1:50 p.m. UTC | #1
On Fri, 04 Aug 2023 10:25:25 +0800, Xiang Yang wrote:
> Smatch reports the warning below:
> drivers/infiniband/core/uverbs_std_types_counters.c:110
> ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ() error: 'uattr'
> dereferencing possible ERR_PTR()
> 
> the return value of uattr maybe ERR_PTR(-ENOENT), fix this by checking
> the value of uattr before using it.
> 
> [...]

Applied, thanks!

[1/1] IB/uverbs: fix an potential error pointer dereference
      https://git.kernel.org/rdma/rdma/c/26b7d1a27167e7

Best regards,
diff mbox series

Patch

diff --git a/drivers/infiniband/core/uverbs_std_types_counters.c b/drivers/infiniband/core/uverbs_std_types_counters.c
index 999da9c79866..381aa5797641 100644
--- a/drivers/infiniband/core/uverbs_std_types_counters.c
+++ b/drivers/infiniband/core/uverbs_std_types_counters.c
@@ -107,6 +107,8 @@  static int UVERBS_HANDLER(UVERBS_METHOD_COUNTERS_READ)(
 		return ret;
 
 	uattr = uverbs_attr_get(attrs, UVERBS_ATTR_READ_COUNTERS_BUFF);
+	if (IS_ERR(uattr))
+		return PTR_ERR(uattr);
 	read_attr.ncounters = uattr->ptr_attr.len / sizeof(u64);
 	read_attr.counters_buff = uverbs_zalloc(
 		attrs, array_size(read_attr.ncounters, sizeof(u64)));