diff options
| author |   Gustavo A. R. Silva <gustavo@embeddedor.com> | 2018-04-12 11:23:51 -0500 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-04-23 14:24:47 +0200 |
| commit | 9962d86dda3b99d2c7b4b87c921dd1c607a636e0 (patch) | |
| tree | c938b2e0c1eb2f30226034124627c72cedd88c50 /drivers/staging/ks7010/ks7010_sdio.c | |
| parent | staging: ks7010: Replace mdelay with usleep_range in ks7010_upload_firmware (diff) | |
| download | linux-dev-9962d86dda3b99d2c7b4b87c921dd1c607a636e0.tar.xz linux-dev-9962d86dda3b99d2c7b4b87c921dd1c607a636e0.zip | |
staging: ks7010_sdio: fix NULL pointer dereference and memory leak
priv is being explicitly dereferenced when it is still null, when
jumping to goto label err_free_netdev, before it is properly
updated with a valid memory address.
Also, when this happens, memory allocated for netdev at line 854:
netdev = alloc_etherdev(sizeof(*priv)) is not being free'd before
return, hence there is a memory leak.
The current code looks a bit too complicated and can be replaced
by just directly freeing netdev before return.
Notice that card->priv = NULL isn't required because the next thing
we do to card is kfree(card).
Addresses-Coverity-ID: 1467844 ("Explicit null dereferenced")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/ks7010/ks7010_sdio.c')
| -rw-r--r-- | drivers/staging/ks7010/ks7010_sdio.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/staging/ks7010/ks7010_sdio.c b/drivers/staging/ks7010/ks7010_sdio.c index b5b8d362fc26..ec2e9bf395b1 100644 --- a/drivers/staging/ks7010/ks7010_sdio.c +++ b/drivers/staging/ks7010/ks7010_sdio.c @@ -984,8 +984,7 @@ static int ks7010_sdio_probe(struct sdio_func *func, return 0; err_free_netdev: - free_netdev(priv->net_dev); - card->priv = NULL; + free_netdev(netdev); err_release_irq: sdio_claim_host(func); sdio_release_irq(func); |