Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-11 21:52:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

USB: whci-hcd: Fix potential memory leak in qset_add_urb_sg()

Browse Source 
Do not leak memory by updating pointer with potentially
NULL realloc return value.

By the way remove unused local variable:
	struct whc_page_list_entry *entry;
More precisely, it was used to increment uninitialized value within one of cycles.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alexey Khoroshilov 2012-08-08 12:53:07 +04:00 committed by Greg Kroah-Hartman
parent e58ba01e2c
commit 05f2b39123
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/usb/host/whci/qset.c
View File

@ -436,7 +436,7 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
int i;
int ntds = 0;
struct whc_std *std = NULL;
struct whc_page_list_entry *entry;
struct whc_page_list_entry *new_pl_virt;
dma_addr_t prev_end = 0;
size_t pl_len;
int p = 0;
@ -508,12 +508,15 @@ static int qset_add_urb_sg(struct whc *whc, struct whc_qset *qset, struct urb *u
pl_len = std->num_pointers * sizeof(struct whc_page_list_entry);
std->pl_virt = krealloc(std->pl_virt, pl_len, mem_flags);
if (std->pl_virt == NULL) {
new_pl_virt = krealloc(std->pl_virt, pl_len, mem_flags);
if (new_pl_virt == NULL) {
kfree(std->pl_virt);
std->pl_virt = NULL;
return -ENOMEM;
}
std->pl_virt = new_pl_virt;
for (;p < std->num_pointers; p++, entry++) {
for (;p < std->num_pointers; p++) {
std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
dma_addr = (dma_addr + WHCI_PAGE_SIZE) & ~(WHCI_PAGE_SIZE-1);
}