Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 042b0159 authored by Ira Weiny's avatar Ira Weiny Committed by Doug Ledford
Browse files

IB/hfi1: Handle kzalloc failure in init_pervl_scs 



Checking the return value of the memory allocation call in
init_pervl_scs() was missed.  Recently the kmalloc() was changed to
kzalloc() which identified the problem.

While fixing this issue 2 other bugs were noticed.  First, the array
being allocated is accessed in the nomem path which can be reached before
it is allocated.  Second, kernel_send_context was not released on error.
Fix both of these by creating a more common memory unwind label structure.

Fixes: 35f6befc ("staging/rdma/hfi1: Add qp to send context mapping for PIO")
Reported-by: default avatarLeon Romanovsky <leon@kernel.org>
Reviewed-by: default avatarMike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarIra Weiny <ira.weiny@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 527dbf12

drivers/infiniband/hw/hfi1/pio.c

+16 −3
Original line number Original line Diff line number Diff line
@@ -1952,13 +1952,17 @@ int init_pervl_scs(struct hfi1_devdata *dd) 
	dd->vld[15].sc = sc_alloc(dd, SC_VL15,

	dd->vld[15].sc = sc_alloc(dd, SC_VL15,

				  dd->rcd[0]->rcvhdrqentsize, dd->node);

				  dd->rcd[0]->rcvhdrqentsize, dd->node);

	if (!dd->vld[15].sc)

	if (!dd->vld[15].sc)

		goto nomem;

		return -ENOMEM;



	hfi1_init_ctxt(dd->vld[15].sc);

	hfi1_init_ctxt(dd->vld[15].sc);

	dd->vld[15].mtu = enum_to_mtu(OPA_MTU_2048);

	dd->vld[15].mtu = enum_to_mtu(OPA_MTU_2048);





	dd->kernel_send_context = kzalloc_node(dd->num_send_contexts *

	dd->kernel_send_context = kzalloc_node(dd->num_send_contexts *

					sizeof(struct send_context *),

					sizeof(struct send_context *),

					GFP_KERNEL, dd->node);

					GFP_KERNEL, dd->node);

	if (!dd->kernel_send_context)

		goto freesc15;



	dd->kernel_send_context[0] = dd->vld[15].sc;

	dd->kernel_send_context[0] = dd->vld[15].sc;





	for (i = 0; i < num_vls; i++) {

	for (i = 0; i < num_vls; i++) {
@@ -2010,12 +2014,21 @@ int init_pervl_scs(struct hfi1_devdata *dd) 
	if (pio_map_init(dd, ppd->port - 1, num_vls, NULL))

	if (pio_map_init(dd, ppd->port - 1, num_vls, NULL))

		goto nomem;

		goto nomem;

	return 0;

	return 0;



nomem:

nomem:

	sc_free(dd->vld[15].sc);

	for (i = 0; i < num_vls; i++) {

	for (i = 0; i < num_vls; i++)

		sc_free(dd->vld[i].sc);

		sc_free(dd->vld[i].sc);

		dd->vld[i].sc = NULL;

	}



	for (i = num_vls; i < INIT_SC_PER_VL * num_vls; i++)

	for (i = num_vls; i < INIT_SC_PER_VL * num_vls; i++)

		sc_free(dd->kernel_send_context[i + 1]);

		sc_free(dd->kernel_send_context[i + 1]);



	kfree(dd->kernel_send_context);

	dd->kernel_send_context = NULL;



freesc15:

	sc_free(dd->vld[15].sc);

	return -ENOMEM;

	return -ENOMEM;

}

}