Skip to content

F
FMC Bus
Commit 5de8348d authored by Dan Carpenter's avatar Dan Carpenter Committed by Alessandro Rubini
Browse files
Options

FMC: NULL dereference on allocation failure 

If we don't allocate "arr" then the cleanup path will dereference it and
oops.
Signed-off-by: 's avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: Alessandro Rubini's avatarAlessandro Rubini <rubini@gnudd.com>
Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 27e6b003
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 5 deletions
kernel/fmc-sdb.c
View file @ 5de8348d
......@@ -46,16 +46,17 @@ static struct sdb_array *__fmc_scan_sdb_tree(struct fmc_device *fmc,
onew = __sdb_rd(fmc, sdb_addr + 4, convert);
n = __be16_to_cpu(*(uint16_t *)&onew);
arr = kzalloc(sizeof(*arr), GFP_KERNEL);
if (arr) {
arr->record = kzalloc(sizeof(arr->record[0]) * n, GFP_KERNEL);
arr->subtree = kzalloc(sizeof(arr->subtree[0]) * n, GFP_KERNEL);
}
if (!arr || !arr->record || !arr->subtree) {
if (!arr)
return ERR_PTR(-ENOMEM);
arr->record = kzalloc(sizeof(arr->record[0]) * n, GFP_KERNEL);
arr->subtree = kzalloc(sizeof(arr->subtree[0]) * n, GFP_KERNEL);
if (!arr->record || !arr->subtree) {
kfree(arr->record);
kfree(arr->subtree);
kfree(arr);
return ERR_PTR(-ENOMEM);
}
arr->len = n;
arr->level = level;
arr->fmc = fmc;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment