We accidentally forgot to set "ret" on this error path so it means we
return NULL instead of an error pointer. The caller checks for NULL and
changes it to an error pointer so it doesn't cause an issue at run time.
Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com>
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c
index 9edabce0b8ab..5b44ef226904 100644
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -61,8 +61,10 @@ static struct sg_table *map_udmabuf(struct dma_buf_attachment *at,
GFP_KERNEL);
if (ret < 0)
goto err;
- if (!dma_map_sg(at->dev, sg->sgl, sg->nents, direction))
+ if (!dma_map_sg(at->dev, sg->sgl, sg->nents, direction)) {
+ ret = -EINVAL;
goto err;
+ }
return sg;
err:
On Wed, Sep 12, 2018 at 05:08:52PM +0200, Arnd Bergmann wrote:
> The .ioctl and .compat_ioctl file operations have the same prototype so
> they can both point to the same function, which works great almost all
> the time when all the commands are compatible.
>
> One exception is the s390 architecture, where a compat pointer is only
> 31 bit wide, and converting it into a 64-bit pointer requires calling
> compat_ptr(). Most drivers here will ever run in s390, but since we now
> have a generic helper for it, it's easy enough to use it consistently.
>
> I double-checked all these drivers to ensure that all ioctl arguments
> are used as pointers or are ignored, but are not interpreted as integer
> values.
>
> Signed-off-by: Arnd Bergmann <arnd(a)arndb.de>
Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>