Subject: Re: [PATCH net-next v2 01/11] openvswitch: Allow each vport to have an array of 'port_id's.

From: Nikolay Aleksandrov <[email-masked]>
Date: Tue, 15 Jul 2014 19:31:04 +0200

<snip>
> +/**
> + *	ovs_vport_set_upcall_portids - set upcall portids of @vport.
> + *
> + * @vport: vport to modify.
> + * @ids: new configuration, an array of port ids.
> + *
> + * Sets the vport's upcall_portids to @ids.
> + *
> + * Returns 0 if successful, -EINVAL if @ids is zero length or cannot be parsed
> + * as an array of U32.
> + *
> + * Must be called with ovs_mutex.
> + */
> +int ovs_vport_set_upcall_portids(struct vport *vport,  struct nlattr *ids)
> +{
> +	struct vport_portids *old, *vport_portids;
> +
> +	if (!nla_len(ids) || nla_len(ids) % sizeof(u32))
> +		return -EINVAL;
> +
> +	old = ovsl_dereference(vport->upcall_portids);
> +
> +	vport_portids = kmalloc(sizeof(*vport_portids) + nla_len(ids),
> +				GFP_KERNEL);
^^^^^^^
Shouldn't there be a null check after the kmalloc instead of directly
dereferencing vport_portids ?

> +	vport_portids->n_ids = nla_len(ids) / sizeof(u32);
> +	vport_portids->rn_ids = reciprocal_value(vport_portids->n_ids);
> +	nla_memcpy(vport_portids->ids, ids, nla_len(ids));
> +
> +	rcu_assign_pointer(vport->upcall_portids, vport_portids);
> +
> +	if (old)
> +		call_rcu(&old->rcu, vport_portids_destroy_rcu_cb);
> +
> +	return 0;
> +}
<snip>