Commit d87ff58f authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

ipheth: potential null dereferences on error path

The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
parameter list but those could be NULL.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Acked-by: default avatarL. Alberto Giménez <agimenez@sysvalve.es>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2a915157
...@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone) ...@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
tx_urb = usb_alloc_urb(0, GFP_KERNEL); tx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (tx_urb == NULL) if (tx_urb == NULL)
goto error; goto error_nomem;
rx_urb = usb_alloc_urb(0, GFP_KERNEL); rx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (rx_urb == NULL) if (rx_urb == NULL)
goto error; goto free_tx_urb;
tx_buf = usb_buffer_alloc(iphone->udev, tx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE, IPHETH_BUF_SIZE,
GFP_KERNEL, GFP_KERNEL,
&tx_urb->transfer_dma); &tx_urb->transfer_dma);
if (tx_buf == NULL) if (tx_buf == NULL)
goto error; goto free_rx_urb;
rx_buf = usb_buffer_alloc(iphone->udev, rx_buf = usb_buffer_alloc(iphone->udev,
IPHETH_BUF_SIZE, IPHETH_BUF_SIZE,
GFP_KERNEL, GFP_KERNEL,
&rx_urb->transfer_dma); &rx_urb->transfer_dma);
if (rx_buf == NULL) if (rx_buf == NULL)
goto error; goto free_tx_buf;
iphone->tx_urb = tx_urb; iphone->tx_urb = tx_urb;
...@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone) ...@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
iphone->rx_buf = rx_buf; iphone->rx_buf = rx_buf;
return 0; return 0;
error: free_tx_buf:
usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
rx_urb->transfer_dma);
usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf, usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
tx_urb->transfer_dma); tx_urb->transfer_dma);
free_rx_urb:
usb_free_urb(rx_urb); usb_free_urb(rx_urb);
free_tx_urb:
usb_free_urb(tx_urb); usb_free_urb(tx_urb);
error_nomem:
return -ENOMEM; return -ENOMEM;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment