| Message ID | 20201013184236.5231-1-rpearson@hpe.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
| Series | [for-next] RDMA/rxe - Respond to skb_clone failure in rxe_recv.c | expand |
On Wed, Oct 14, 2020 at 2:44 AM Bob Pearson <rpearsonhpe@gmail.com> wrote: > > If skb_clone is unable to allocate memory for a new > sk_buff this is not detected by the current code. > > Check for a NULL return and continue. This is similar to > other errors in this loop over QPs attached to the multicast address > and consistent with the unreliable UD transport. > > Fixes: e7ec96fc7932f ("RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()") Addresses-Coverity-ID: 1497804: Null pointer dereferences (NULL_RETURNS) Thanks Zhu Yanjun > Signed-off-by: Bob Pearson <rpearson@hpe.com> > --- > drivers/infiniband/sw/rxe/rxe_recv.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c > index 11f3daf20768..c9984a28eecc 100644 > --- a/drivers/infiniband/sw/rxe/rxe_recv.c > +++ b/drivers/infiniband/sw/rxe/rxe_recv.c > @@ -271,6 +271,9 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb) > else > per_qp_skb = skb; > > + if (unlikely(!per_qp_skb)) > + continue; > + > per_qp_pkt = SKB_TO_PKT(per_qp_skb); > per_qp_pkt->qp = qp; > rxe_add_ref(qp); > -- > 2.25.1 >
On Tue, Oct 13, 2020 at 01:42:37PM -0500, Bob Pearson wrote: > If skb_clone is unable to allocate memory for a new > sk_buff this is not detected by the current code. > > Check for a NULL return and continue. This is similar to > other errors in this loop over QPs attached to the multicast address > and consistent with the unreliable UD transport. > > Fixes: e7ec96fc7932f ("RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()") > Signed-off-by: Bob Pearson <rpearson@hpe.com> > --- > drivers/infiniband/sw/rxe/rxe_recv.c | 3 +++ > 1 file changed, 3 insertions(+) Subject should be 'RDMA/rxe:' not '-' Place () after function names for clarity Flow text to the full 76 lines I fixed it all up and applied to for-next Thanks, Jason
diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c index 11f3daf20768..c9984a28eecc 100644 --- a/drivers/infiniband/sw/rxe/rxe_recv.c +++ b/drivers/infiniband/sw/rxe/rxe_recv.c @@ -271,6 +271,9 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb) else per_qp_skb = skb; + if (unlikely(!per_qp_skb)) + continue; + per_qp_pkt = SKB_TO_PKT(per_qp_skb); per_qp_pkt->qp = qp; rxe_add_ref(qp);
If skb_clone is unable to allocate memory for a new sk_buff this is not detected by the current code. Check for a NULL return and continue. This is similar to other errors in this loop over QPs attached to the multicast address and consistent with the unreliable UD transport. Fixes: e7ec96fc7932f ("RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()") Signed-off-by: Bob Pearson <rpearson@hpe.com> --- drivers/infiniband/sw/rxe/rxe_recv.c | 3 +++ 1 file changed, 3 insertions(+)