lkml.org 
[lkml]   [2020]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 523/639] media: em28xx: Fix exception handling in em28xx_alloc_urbs()
    Date
    From: Markus Elfring <elfring@users.sourceforge.net>

    [ Upstream commit ecbce48f1ff2442371ebcd12ec0ecddb431fbd72 ]

    A null pointer would be passed to a call of the function "kfree" directly
    after a call of the function "kcalloc" failed at one place.
    Pass the data structure member "urb" instead for which memory
    was allocated before (so that this resource will be properly cleaned up).

    This issue was detected by using the Coccinelle software.

    Fixes: d571b592c6206d33731f41aa710fa0f69ac8611b ("media: em28xx: don't use coherent buffer for DMA transfers")
    Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/em28xx/em28xx-core.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
    index 5657f8710ca6b..69445c8e38e28 100644
    --- a/drivers/media/usb/em28xx/em28xx-core.c
    +++ b/drivers/media/usb/em28xx/em28xx-core.c
    @@ -930,7 +930,7 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,

    usb_bufs->buf = kcalloc(num_bufs, sizeof(void *), GFP_KERNEL);
    if (!usb_bufs->buf) {
    - kfree(usb_bufs->buf);
    + kfree(usb_bufs->urb);
    return -ENOMEM;
    }

    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-24 12:30    [W:2.866 / U:2.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site