| From oneukum@suse.de Mon Mar 19 03:39:14 2007 |
| From: Oliver Neukum <oneukum@suse.de> |
| To: linux-usb-devel@lists.sourceforge.net |
| Subject: USB: iowarrior.c: fix NULL dereference |
| Date: Mon, 19 Mar 2007 11:39:13 +0100 |
| Cc: Adrian Bunk <bunk@stusta.de>, |
| Christian Lucht <lucht@codemercs.com>, |
| Robert Marquardt <marquardt@codemercs.com>, |
| Greg Kroah-Hartman <gregkh@suse.de>, linux-kernel@vger.kernel.org |
| Message-Id: <200703191139.14026.oneukum@suse.de> |
| |
| Am Montag, 19. 2007 10:25 schrieb Adrian Bunk: |
| > The Coverity checker spotted the following NULL dereference: |
| |
| And this fixes an oops upon allocation failures. |
| |
| Signed-off-by: Oliver Neukum <oneukum@suse.de> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/usb/misc/iowarrior.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/usb/misc/iowarrior.c |
| +++ b/drivers/usb/misc/iowarrior.c |
| @@ -417,14 +417,14 @@ static ssize_t iowarrior_write(struct fi |
| if (!int_out_urb) { |
| retval = -ENOMEM; |
| dbg("%s Unable to allocate urb ", __func__); |
| - goto error; |
| + goto error_no_urb; |
| } |
| buf = usb_buffer_alloc(dev->udev, dev->report_size, |
| GFP_KERNEL, &int_out_urb->transfer_dma); |
| if (!buf) { |
| retval = -ENOMEM; |
| dbg("%s Unable to allocate buffer ", __func__); |
| - goto error; |
| + goto error_no_buffer; |
| } |
| usb_fill_int_urb(int_out_urb, dev->udev, |
| usb_sndintpipe(dev->udev, |
| @@ -459,7 +459,9 @@ static ssize_t iowarrior_write(struct fi |
| error: |
| usb_buffer_free(dev->udev, dev->report_size, buf, |
| int_out_urb->transfer_dma); |
| +error_no_buffer: |
| usb_free_urb(int_out_urb); |
| +error_no_urb: |
| atomic_dec(&dev->write_busy); |
| wake_up_interruptible(&dev->write_wait); |
| exit: |
