Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

lan78xx: Fix memory allocation bug 

Fix memory allocation that fails to check for NULL return.

Signed-off-by: John Efstathiades <john.efstathiades@pebblebay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
John Efstathiades 2021-11-18 11:01:34 +00:00 committed by David S. Miller
parent d091ec975b
commit a6df95cae4
1 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
drivers/net/usb/lan78xx.c
View File

@ -4106,18 +4106,20 @@ static int lan78xx_probe(struct usb_interface *intf,
period = ep_intr->desc.bInterval; period = ep_intr->desc.bInterval;
maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0); maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0);
buf = kmalloc(maxp, GFP_KERNEL); buf = kmalloc(maxp, GFP_KERNEL);
if (buf) { if (!buf) {
dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL); ret = -ENOMEM;
if (!dev->urb_intr) { goto out3;
ret = -ENOMEM; }
kfree(buf);
goto out3; dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
} else { if (!dev->urb_intr) {
usb_fill_int_urb(dev->urb_intr, dev->udev, ret = -ENOMEM;
dev->pipe_intr, buf, maxp, goto out4;
intr_complete, dev, period); } else {
dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; usb_fill_int_urb(dev->urb_intr, dev->udev,
} dev->pipe_intr, buf, maxp,
intr_complete, dev, period);
dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
} }
dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1);
@ -4125,7 +4127,7 @@ static int lan78xx_probe(struct usb_interface *intf,
/* Reject broken descriptors. */ /* Reject broken descriptors. */
if (dev->maxpacket == 0) { if (dev->maxpacket == 0) {
ret = -ENODEV; ret = -ENODEV;
goto out4; goto out5;
} }
/* driver requires remote-wakeup capability during autosuspend. */ /* driver requires remote-wakeup capability during autosuspend. */
@ -4133,12 +4135,12 @@ static int lan78xx_probe(struct usb_interface *intf,
ret = lan78xx_phy_init(dev); ret = lan78xx_phy_init(dev);
if (ret < 0) if (ret < 0)
goto out4; goto out5;
ret = register_netdev(netdev); ret = register_netdev(netdev);
if (ret != 0) { if (ret != 0) {
netif_err(dev, probe, netdev, "couldn't register the device\n"); netif_err(dev, probe, netdev, "couldn't register the device\n");
goto out5; goto out6;
} }
usb_set_intfdata(intf, dev); usb_set_intfdata(intf, dev);
@ -4153,10 +4155,12 @@ static int lan78xx_probe(struct usb_interface *intf,
return 0; return 0;
out5: out6:
phy_disconnect(netdev->phydev); phy_disconnect(netdev->phydev);
out4: out5:
usb_free_urb(dev->urb_intr); usb_free_urb(dev->urb_intr);
out4:
kfree(buf);
out3: out3:
lan78xx_unbind(dev, intf); lan78xx_unbind(dev, intf);
out2: out2: