summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2018-09-26 13:39:34 +0300
committerDominique Martinet <dominique.martinet@cea.fr>2018-10-10 09:13:20 +0900
commit72ea0321088df2c41eca8cc6160c24bcceb56ac7 (patch)
treefb8a445b0bf4ff97635282e4edc2c799fbc60e3a
parentb4dc44b3cac9e8327e0655f530ed0c46f2e6214c (diff)
downloadlinux-72ea0321088df2c41eca8cc6160c24bcceb56ac7.tar.gz
linux-72ea0321088df2c41eca8cc6160c24bcceb56ac7.tar.bz2
linux-72ea0321088df2c41eca8cc6160c24bcceb56ac7.zip
9p: potential NULL dereference
p9_tag_alloc() is supposed to return error pointers, but we accidentally return a NULL here. It would cause a NULL dereference in the caller. Link: http://lkml.kernel.org/m/20180926103934.GA14535@mwanda Fixes: 996d5b4db4b1 ("9p: Use a slab for allocating requests") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
-rw-r--r--net/9p/client.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/9p/client.c b/net/9p/client.c
index 47fa6158a75a..5f23e18eecc0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -281,7 +281,7 @@ p9_tag_alloc(struct p9_client *c, int8_t type, unsigned int max_size)
int tag;
if (!req)
- return NULL;
+ return ERR_PTR(-ENOMEM);
if (p9_fcall_init(c, &req->tc, alloc_msize))
goto free_req;