From: Dan Carpenter <error27@gmail.com>
To: Diego Giagio <diego@giagio.com>
Cc: "David S. Miller" <davem@davemloft.net>,
"L. Alberto Giménez" <agimenez@sysvalve.es>,
netdev@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [patch] ipheth: potential null dereferences on error path
Date: Tue, 27 Apr 2010 09:20:12 +0000 [thread overview]
Message-ID: <20100427092012.GA29093@bicker> (raw)
The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
parameter list but those could be NULL.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index fd10331..418825d 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
tx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (tx_urb = NULL)
- goto error;
+ goto error_nomem;
rx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (rx_urb = NULL)
- goto error;
+ goto free_tx_urb;
tx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&tx_urb->transfer_dma);
if (tx_buf = NULL)
- goto error;
+ goto free_rx_urb;
rx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&rx_urb->transfer_dma);
if (rx_buf = NULL)
- goto error;
+ goto free_tx_buf;
iphone->tx_urb = tx_urb;
@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
iphone->rx_buf = rx_buf;
return 0;
-error:
- usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
- rx_urb->transfer_dma);
+free_tx_buf:
usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
tx_urb->transfer_dma);
+free_rx_urb:
usb_free_urb(rx_urb);
+free_tx_urb:
usb_free_urb(tx_urb);
+error_nomem:
return -ENOMEM;
}
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <error27@gmail.com>
To: Diego Giagio <diego@giagio.com>
Cc: "David S. Miller" <davem@davemloft.net>,
"L. Alberto Giménez" <agimenez@sysvalve.es>,
netdev@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [patch] ipheth: potential null dereferences on error path
Date: Tue, 27 Apr 2010 11:20:12 +0200 [thread overview]
Message-ID: <20100427092012.GA29093@bicker> (raw)
The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
parameter list but those could be NULL.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index fd10331..418825d 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
tx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (tx_urb == NULL)
- goto error;
+ goto error_nomem;
rx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (rx_urb == NULL)
- goto error;
+ goto free_tx_urb;
tx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&tx_urb->transfer_dma);
if (tx_buf == NULL)
- goto error;
+ goto free_rx_urb;
rx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&rx_urb->transfer_dma);
if (rx_buf == NULL)
- goto error;
+ goto free_tx_buf;
iphone->tx_urb = tx_urb;
@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
iphone->rx_buf = rx_buf;
return 0;
-error:
- usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
- rx_urb->transfer_dma);
+free_tx_buf:
usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
tx_urb->transfer_dma);
+free_rx_urb:
usb_free_urb(rx_urb);
+free_tx_urb:
usb_free_urb(tx_urb);
+error_nomem:
return -ENOMEM;
}
next reply other threads:[~2010-04-27 9:20 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-04-27 9:20 Dan Carpenter [this message]
2010-04-27 9:20 ` [patch] ipheth: potential null dereferences on error path Dan Carpenter
2010-04-27 21:00 ` L. Alberto Giménez
2010-04-27 21:00 ` L. Alberto Giménez
2010-04-27 21:33 ` David Miller
2010-04-27 21:33 ` David Miller
2010-04-27 21:43 ` L. Alberto Giménez
2010-04-27 21:43 ` L. Alberto Giménez
2010-04-27 21:49 ` David Miller
2010-04-27 21:49 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100427092012.GA29093@bicker \
--to=error27@gmail.com \
--cc=agimenez@sysvalve.es \
--cc=davem@davemloft.net \
--cc=diego@giagio.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.