Messages in this thread | | | Date | Fri, 17 Nov 2023 16:27:17 +0200 | From | Louis Peens <> | Subject | Re: [PATCH] nfp: flower: Added pointer check and continue. |
| |
On Fri, Nov 17, 2023 at 03:57:01PM +0300, Denis Arefev wrote: > > Return value of a function 'kmalloc_array' is dereferenced at > lag_conf.c without checking for null, but it is usually > checked for this function. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Signed-off-by: Denis Arefev <arefev@swemel.ru> > --- > drivers/net/ethernet/netronome/nfp/flower/lag_conf.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c > index 88d6d992e7d0..8cc6cce73283 100644 > --- a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c > +++ b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c > @@ -339,6 +339,11 @@ static void nfp_fl_lag_do_work(struct work_struct *work) > acti_netdevs = kmalloc_array(entry->slave_cnt, > sizeof(*acti_netdevs), GFP_KERNEL); > > + if (!acti_netdevs) { > + schedule_delayed_work(&lag->work, NFP_FL_LAG_DELAY); > + continue; > + } > + Thanks for reporting this Denis, it definitely seems to be an oversight. Would you mind adding a 'nfp_flower_cmsg_warn' here as well, so that this case does not go undetected? Maybe something like "cannot allocate memory for group processing" can work.
> /* Include sanity check in the loop. It may be that a bond has > * changed between processing the last notification and the > * work queue triggering. If the number of slaves has changed > -- > 2.25.1 >
| |