Commit 093ccc2f authored Nov 21, 2022 by YueHaibing Committed by Greg Kroah-Hartman Dec 08, 2022

net/mlx5: Fix uninitialized variable bug in outlen_write()



[ Upstream commit 3f5769a074c13d8f08455e40586600419e02a880 ]

If sscanf() return 0, outlen is uninitialized and used in kzalloc(),
this is unexpected. We should return -EINVAL if the string is invalid.

Fixes: e126ba97 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent b10dd3bd

drivers/net/ethernet/mellanox/mlx5/core/cmd.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1417,8 +1417,8 @@ static ssize_t outlen_write(struct file filp, const char __user buf,
		return -EFAULT;

		err = sscanf(outlen_str, "%d", &outlen);
		if (err < 0)
		return err;
		if (err != 1)
		return -EINVAL;

		ptr = kzalloc(outlen, GFP_KERNEL);
		if (!ptr)