9p: potential NULL dereference

p9_tag_alloc() is supposed to return error pointers, but we accidentally
return a NULL here.  It would cause a NULL dereference in the caller.

Link: http://lkml.kernel.org/m/20180926103934.GA14535@mwanda
Fixes: 996d5b4db4b1 ("9p: Use a slab for allocating requests")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>

diff --git a/net/9p/client.c b/net/9p/client.c
index 47fa6158a75a4ced05489db105d0b64b500ae072..5f23e18eecc02f32ac80ddd85658006f9ad15430 100644 (file)
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -281,7 +281,7 @@ p9_tag_alloc(struct p9_client *c, int8_t type, unsigned int max_size)
        int tag;
 
        if (!req)
-               return NULL;
+               return ERR_PTR(-ENOMEM);
 
        if (p9_fcall_init(c, &req->tc, alloc_msize))
                goto free_req;