* [patch] ipheth: potential null dereferences on error path
@ 2010-04-27 9:20 Dan Carpenter
2010-04-27 21:00 ` L. Alberto Giménez
2010-04-27 21:43 ` L. Alberto Giménez
0 siblings, 2 replies; 5+ messages in thread
From: Dan Carpenter @ 2010-04-27 9:20 UTC (permalink / raw)
To: Diego Giagio
Cc: David S. Miller, L. Alberto Giménez, netdev, kernel-janitors
The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
parameter list but those could be NULL.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
index fd10331..418825d 100644
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
tx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (tx_urb == NULL)
- goto error;
+ goto error_nomem;
rx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (rx_urb == NULL)
- goto error;
+ goto free_tx_urb;
tx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&tx_urb->transfer_dma);
if (tx_buf == NULL)
- goto error;
+ goto free_rx_urb;
rx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE,
GFP_KERNEL,
&rx_urb->transfer_dma);
if (rx_buf == NULL)
- goto error;
+ goto free_tx_buf;
iphone->tx_urb = tx_urb;
@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
iphone->rx_buf = rx_buf;
return 0;
-error:
- usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
- rx_urb->transfer_dma);
+free_tx_buf:
usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
tx_urb->transfer_dma);
+free_rx_urb:
usb_free_urb(rx_urb);
+free_tx_urb:
usb_free_urb(tx_urb);
+error_nomem:
return -ENOMEM;
}
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [patch] ipheth: potential null dereferences on error path
2010-04-27 9:20 [patch] ipheth: potential null dereferences on error path Dan Carpenter
@ 2010-04-27 21:00 ` L. Alberto Giménez
2010-04-27 21:33 ` David Miller
2010-04-27 21:43 ` L. Alberto Giménez
1 sibling, 1 reply; 5+ messages in thread
From: L. Alberto Giménez @ 2010-04-27 21:00 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Diego Giagio, David S. Miller, netdev, kernel-janitors
On Tue, Apr 27, 2010 at 11:20:12AM +0200, Dan Carpenter wrote:
> The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
> parameter list but those could be NULL.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Seems good to me (should I ack it or any other kind of singoff?).
--
L. Alberto Giménez
JabberID agimenez@jabber.sysvalve.es
GnuPG key ID 0x3BAABDE1
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [patch] ipheth: potential null dereferences on error path
2010-04-27 21:00 ` L. Alberto Giménez
@ 2010-04-27 21:33 ` David Miller
0 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2010-04-27 21:33 UTC (permalink / raw)
To: agimenez; +Cc: error27, diego, netdev, kernel-janitors
From: L. Alberto Giménez <agimenez@sysvalve.es>
Date: Tue, 27 Apr 2010 23:00:03 +0200
> On Tue, Apr 27, 2010 at 11:20:12AM +0200, Dan Carpenter wrote:
>> The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
>> parameter list but those could be NULL.
>>
>> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> Seems good to me (should I ack it or any other kind of singoff?).
If you give it an "Acked-by: ..." that would be nice.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [patch] ipheth: potential null dereferences on error path
2010-04-27 9:20 [patch] ipheth: potential null dereferences on error path Dan Carpenter
2010-04-27 21:00 ` L. Alberto Giménez
@ 2010-04-27 21:43 ` L. Alberto Giménez
2010-04-27 21:49 ` David Miller
1 sibling, 1 reply; 5+ messages in thread
From: L. Alberto Giménez @ 2010-04-27 21:43 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Diego Giagio, David S. Miller, netdev, kernel-janitors
On Tue, Apr 27, 2010 at 11:20:12AM +0200, Dan Carpenter wrote:
> The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
> parameter list but those could be NULL.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: L. Alberto Giménez <agimenez@sysvalve.es>
--
L. Alberto Giménez
JabberID agimenez@jabber.sysvalve.es
GnuPG key ID 0x3BAABDE1
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [patch] ipheth: potential null dereferences on error path
2010-04-27 21:43 ` L. Alberto Giménez
@ 2010-04-27 21:49 ` David Miller
0 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2010-04-27 21:49 UTC (permalink / raw)
To: agimenez; +Cc: error27, diego, netdev, kernel-janitors
From: L. Alberto Giménez <agimenez@sysvalve.es>
Date: Tue, 27 Apr 2010 23:43:47 +0200
> On Tue, Apr 27, 2010 at 11:20:12AM +0200, Dan Carpenter wrote:
>> The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
>> parameter list but those could be NULL.
>>
>> Signed-off-by: Dan Carpenter <error27@gmail.com>
>
> Acked-by: L. Alberto Giménez <agimenez@sysvalve.es>
Applied, thanks everyone.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2010-04-27 21:49 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-04-27 9:20 [patch] ipheth: potential null dereferences on error path Dan Carpenter
2010-04-27 21:00 ` L. Alberto Giménez
2010-04-27 21:33 ` David Miller
2010-04-27 21:43 ` L. Alberto Giménez
2010-04-27 21:49 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).