Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c3a6f7e authored by Vitaly Kuznetsov's avatar Vitaly Kuznetsov Committed by Greg Kroah-Hartman
Browse files

Drivers: hv: check vmbus_device_create() return value in vmbus_process_offer() 



vmbus_device_create() result is not being checked in vmbus_process_offer() and
it can fail if kzalloc() fails. Add the check and do minor cleanup to avoid
additional duplication of "free_channel(); return;" block.

Reported-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Acked-by: default avatarJason Wang <jasowang@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c3762b24

drivers/hv/channel_mgmt.c

+9 −5
Original line number Original line Diff line number Diff line
@@ -341,11 +341,10 @@ static void vmbus_process_offer(struct work_struct *work) 
			if (channel->sc_creation_callback != NULL)

			if (channel->sc_creation_callback != NULL)

				channel->sc_creation_callback(newchannel);

				channel->sc_creation_callback(newchannel);





			return;

			goto out;

		}

		}





		free_channel(newchannel);

		goto err_free_chan;

		return;

	}

	}





	/*

	/*
@@ -364,6 +363,8 @@ static void vmbus_process_offer(struct work_struct *work) 
		&newchannel->offermsg.offer.if_type,

		&newchannel->offermsg.offer.if_type,

		&newchannel->offermsg.offer.if_instance,

		&newchannel->offermsg.offer.if_instance,

		newchannel);

		newchannel);

	if (!newchannel->device_obj)

		goto err_free_chan;





	/*

	/*

	 * Add the new device to the bus. This will kick off device-driver

	 * Add the new device to the bus. This will kick off device-driver
@@ -379,9 +380,12 @@ static void vmbus_process_offer(struct work_struct *work) 
		list_del(&newchannel->listentry);

		list_del(&newchannel->listentry);

		spin_unlock_irqrestore(&vmbus_connection.channel_lock, flags);

		spin_unlock_irqrestore(&vmbus_connection.channel_lock, flags);

		kfree(newchannel->device_obj);

		kfree(newchannel->device_obj);



		goto err_free_chan;

		free_channel(newchannel);

	}

	}

out:

	return;

err_free_chan:

	free_channel(newchannel);

}

}





enum {

enum {