In afs_update_cell(), ret is the result of the DNS lookup and the errors are to be handled by a switch - however, the value gets clobbered in between by setting it to -ENOMEM in case afs_alloc_vlserver_list() fails. Fix this by moving the setting of -ENOMEM into the error handling for OOM failure. Further, only do it if we don't have an alternative error to return. Found by Linux Verification Center (linuxtesting.org) with SVACE. Based on a patch from Anastasia Belova [1].
Unified · Split
| @@ -409,10 +409,12 @@ static int afs_update_cell(struct afs_cell *cell) · 408 unmodified lines | ||
| 409 | 409 | if (ret == -ENOMEM) |
| 410 | 410 | goto out_wake; |
| 411 | 411 | |
| 412 | − ret = -ENOMEM; | |
| 413 | 412 | vllist = afs_alloc_vlserver_list(0); |
| 414 | − if (!vllist) | |
| 413 | + if (!vllist) { | |
| 414 | + if (ret >= 0) | |
| 415 | + ret = -ENOMEM; | |
| 415 | 416 | goto out_wake; |
| 417 | + } | |
| 416 | 418 | |
| 417 | 419 | switch (ret) { |
| 418 | 420 | case -ENODATA: |