The allocation of the reed solomon control structure can fail, but fec_alloc_bufs() ignores that and subsequent operations in dm verity use the potential NULL pointer unconditionally.
Add a proper check and abort if init_rs() fails. Signed-off-by: Thomas Gleixner <t...@linutronix.de> --- drivers/md/dm-verity-fec.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/md/dm-verity-fec.c +++ b/drivers/md/dm-verity-fec.c @@ -308,8 +308,13 @@ static int fec_alloc_bufs(struct dm_veri { unsigned n; - if (!fio->rs) + if (!fio->rs) { fio->rs = mempool_alloc(v->fec->rs_pool, GFP_NOIO); + if (!fio->rs) { + DMERR("failed to allocate RS control structure"); + return -ENOMEM; + } + } fec_for_each_prealloc_buffer(n) { if (fio->bufs[n])