leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

FMC: NULL dereference on allocation failure

Browse Source 
If we don't allocate "arr" then the cleanup path will dereference it and
oops.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2013-06-19 19:01:01 +03:00 committed by Greg Kroah-Hartman
parent e3a3c3a205
commit e42d50baf4
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/fmc/fmc-sdb.c
View File

@ -46,16 +46,17 @@ static struct sdb_array *__fmc_scan_sdb_tree(struct fmc_device *fmc,
onew = __sdb_rd(fmc, sdb_addr + 4, convert); onew = __sdb_rd(fmc, sdb_addr + 4, convert);
n = __be16_to_cpu(*(uint16_t *)&onew); n = __be16_to_cpu(*(uint16_t *)&onew);
arr = kzalloc(sizeof(*arr), GFP_KERNEL); arr = kzalloc(sizeof(*arr), GFP_KERNEL);
if (arr) { if (!arr)
arr->record = kzalloc(sizeof(arr->record[0]) * n, GFP_KERNEL); return ERR_PTR(-ENOMEM);
arr->subtree = kzalloc(sizeof(arr->subtree[0]) * n, GFP_KERNEL); arr->record = kzalloc(sizeof(arr->record[0]) * n, GFP_KERNEL);
} arr->subtree = kzalloc(sizeof(arr->subtree[0]) * n, GFP_KERNEL);
if (!arr || !arr->record || !arr->subtree) { if (!arr->record || !arr->subtree) {
kfree(arr->record); kfree(arr->record);
kfree(arr->subtree); kfree(arr->subtree);
kfree(arr); kfree(arr);
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
arr->len = n; arr->len = n;
arr->level = level; arr->level = level;
arr->fmc = fmc; arr->fmc = fmc;