| Message ID | 20190729030305.18410-1-baijiaju1990@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 0e7bf23e496770323b08a95633f3247e60b3edca |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create() | expand |
Jia-Ju Bai <baijiaju1990@gmail.com> wrote: > In ath6kl_htc_mbox_create(), when kzalloc() on line 2855 fails, > target->dev is assigned to NULL, and ath6kl_htc_mbox_cleanup(target) is > called on line 2885. > > In ath6kl_htc_mbox_cleanup(), target->dev is used on line 2895: > ath6kl_hif_cleanup_scatter(target->dev->ar); > > Thus, a null-pointer dereference may occur. > > To fix this bug, kfree(target) is called and NULL is returned when > kzalloc() on line 2855 fails. > > This bug is found by a static analysis tool STCheck written by us. > > Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-next branch of ath.git, thanks. 0e7bf23e4967 ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create()
diff --git a/drivers/net/wireless/ath/ath6kl/htc_mbox.c b/drivers/net/wireless/ath/ath6kl/htc_mbox.c index 65c31da43c47..998947ef63b6 100644 --- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c +++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c @@ -2855,8 +2855,8 @@ static void *ath6kl_htc_mbox_create(struct ath6kl *ar) target->dev = kzalloc(sizeof(*target->dev), GFP_KERNEL); if (!target->dev) { ath6kl_err("unable to allocate memory\n"); - status = -ENOMEM; - goto err_htc_cleanup; + kfree(target); + return NULL; } spin_lock_init(&target->htc_lock);
In ath6kl_htc_mbox_create(), when kzalloc() on line 2855 fails, target->dev is assigned to NULL, and ath6kl_htc_mbox_cleanup(target) is called on line 2885. In ath6kl_htc_mbox_cleanup(), target->dev is used on line 2895: ath6kl_hif_cleanup_scatter(target->dev->ar); Thus, a null-pointer dereference may occur. To fix this bug, kfree(target) is called and NULL is returned when kzalloc() on line 2855 fails. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- drivers/net/wireless/ath/ath6kl/htc_mbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)