[PATCH 4.17 160/220] um: Fix initialization of vector queues

[Greg Kroah-Hartman]

4.17-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Anton Ivanov <anton.iva...@cambridgegreys.com>

commit 4579a1ba692af81da7ea6ce197f8169ddc0c327f upstream.

UML vector drivers could derefence uninitialized memory
when cleaning up after a queue allocation failure.

Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
Cc: <sta...@vger.kernel.org>
Reported-by: Dan Capenter <dan.carpen...@oracle.com>
Signed-off-by: Anton Ivanov <anton.iva...@cambridgegreys.com>
Signed-off-by: Richard Weinberger <rich...@nod.at>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 arch/um/drivers/vector_kern.c |   15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/arch/um/drivers/vector_kern.c
+++ b/arch/um/drivers/vector_kern.c
@@ -504,15 +504,19 @@ static struct vector_queue *create_queue
 
        result = kmalloc(sizeof(struct vector_queue), GFP_KERNEL);
        if (result == NULL)
-               goto out_fail;
+               return NULL;
        result->max_depth = max_size;
        result->dev = vp->dev;
        result->mmsg_vector = kmalloc(
                (sizeof(struct mmsghdr) * max_size), GFP_KERNEL);
+       if (result->mmsg_vector == NULL)
+               goto out_mmsg_fail;
        result->skbuff_vector = kmalloc(
                (sizeof(void *) * max_size), GFP_KERNEL);
-       if (result->mmsg_vector == NULL || result->skbuff_vector == NULL)
-               goto out_fail;
+       if (result->skbuff_vector == NULL)
+               goto out_skb_fail;
+
+       /* further failures can be handled safely by destroy_queue*/
 
        mmsg_vector = result->mmsg_vector;
        for (i = 0; i < max_size; i++) {
@@ -563,6 +567,11 @@ static struct vector_queue *create_queue
        result->head = 0;
        result->tail = 0;
        return result;
+out_skb_fail:
+       kfree(result->mmsg_vector);
+out_mmsg_fail:
+       kfree(result);
+       return NULL;
 out_fail:
        destroy_queue(result);
        return NULL;