iser-target: Fix non negative ERR_PTR isert_device_get usage

As reported by Dan, isert_create_device_ib_res() failure within
isert_device_get() can potentially return a postive value,
resulting in ERR_PTR() triggering a NULL pointer dereference.

Caught by the static checker:

     drivers/infiniband/ulp/isert/ib_isert.c:423 isert_device_get()
     error: passing non negative 1 to ERR_PTR

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index dfbbbb28090b2301c7742fd28b145b62054a76af..ae84de12e70e73dc9d780278a19e59fb5a0cb9f1 100644 (file)
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -357,7 +357,7 @@ isert_create_device_ib_res(struct isert_device *device)
        dev_attr = &device->dev_attr;
        ret = isert_query_device(device->ib_device, dev_attr);
        if (ret)
-               return ret;
+               goto out;
 
        /* asign function handlers */
        if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS &&
@@ -373,7 +373,7 @@ isert_create_device_ib_res(struct isert_device *device)
 
        ret = isert_alloc_comps(device, dev_attr);
        if (ret)
-               return ret;
+               goto out;
 
        device->pd = ib_alloc_pd(device->ib_device);
        if (IS_ERR(device->pd)) {
@@ -391,6 +391,9 @@ isert_create_device_ib_res(struct isert_device *device)
 
 out_cq:
        isert_free_comps(device);
+out:
+       if (ret > 0)
+               ret = -EINVAL;
        return ret;
 }