| From 6bdd9719a00061d387517cd5690e2130525d5e6b Mon Sep 17 00:00:00 2001 |
| From: Pan Bian <bianpan2016@163.com> |
| Date: Sat, 3 Dec 2016 18:40:25 +0800 |
| Subject: [PATCH 170/255] tty: serial: sh-sci: set error code when kasprintf |
| fails |
| |
| When the call to kasprintf() returns a NULL pointer, function |
| sci_request_irq() frees the preallocated memory and returns 0 is |
| returned. Because 0 means no error, the caller of sci_request_irq() |
| will keep going, and the freed memory may be used or freed again. To |
| avoid the above issue, this patch assigns "-ENOMEM" to the return |
| variable ret. |
| |
| Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188691 |
| |
| Signed-off-by: Pan Bian <bianpan2016@163.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| (cherry picked from commit 623ac1d4a52f279d9379bae61ae1eb37c5767f96) |
| Signed-off-by: Simon Horman <horms+renesas@verge.net.au> |
| --- |
| drivers/tty/serial/sh-sci.c | 4 +++- |
| 1 file changed, 3 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/tty/serial/sh-sci.c |
| +++ b/drivers/tty/serial/sh-sci.c |
| @@ -1755,8 +1755,10 @@ static int sci_request_irq(struct sci_po |
| desc = sci_irq_desc + i; |
| port->irqstr[j] = kasprintf(GFP_KERNEL, "%s:%s", |
| dev_name(up->dev), desc->desc); |
| - if (!port->irqstr[j]) |
| + if (!port->irqstr[j]) { |
| + ret = -ENOMEM; |
| goto out_nomem; |
| + } |
| |
| ret = request_irq(irq, desc->handler, up->irqflags, |
| port->irqstr[j], port); |
