Function chtls_close_conn() defined in drivers/crypto/chelsio/chtls/chtls_cm.c 
calls alloc_skb() to allocate memory for struct sk_buff which is dereferenced 
immediately. As alloc_skb() may return NULL on failure, this code piece may 
cause NULL pointer dereference bug.
---
 drivers/crypto/chelsio/chtls/chtls_cm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c 
b/drivers/crypto/chelsio/chtls/chtls_cm.c
index 0997e16..0e8eec6 100644
--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
@@ -267,6 +267,8 @@ static void chtls_close_conn(struct sock *sk)
        tid = csk->tid;
 
        skb = alloc_skb(len, GFP_KERNEL | __GFP_NOFAIL);
+       if (!skb)
+               return -ENOMEM;
        req = (struct cpl_close_con_req *)__skb_put(skb, len);
        memset(req, 0, len);
        req->wr.wr_hi = htonl(FW_WR_OP_V(FW_TP_WR) |
-- 
2.6.4

Reply via email to