mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-28 07:04:00 +08:00
ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create()
In ath6kl_htc_mbox_create(), when kzalloc() on line 2855 fails, target->dev is assigned to NULL, and ath6kl_htc_mbox_cleanup(target) is called on line 2885. In ath6kl_htc_mbox_cleanup(), target->dev is used on line 2895: ath6kl_hif_cleanup_scatter(target->dev->ar); Thus, a null-pointer dereference may occur. To fix this bug, kfree(target) is called and NULL is returned when kzalloc() on line 2855 fails. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
parent
72bb1aa91f
commit
0e7bf23e49
@ -2855,8 +2855,8 @@ static void *ath6kl_htc_mbox_create(struct ath6kl *ar)
|
||||
target->dev = kzalloc(sizeof(*target->dev), GFP_KERNEL);
|
||||
if (!target->dev) {
|
||||
ath6kl_err("unable to allocate memory\n");
|
||||
status = -ENOMEM;
|
||||
goto err_htc_cleanup;
|
||||
kfree(target);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
spin_lock_init(&target->htc_lock);
|
||||
|
Loading…
Reference in New Issue
Block a user