From a6df95cae40bee555e01a37b4023ce8e97ffa249 Mon Sep 17 00:00:00 2001 From: John Efstathiades Date: Thu, 18 Nov 2021 11:01:34 +0000 Subject: lan78xx: Fix memory allocation bug Fix memory allocation that fails to check for NULL return. Signed-off-by: John Efstathiades Signed-off-by: David S. Miller --- drivers/net/usb/lan78xx.c | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index f20376c1ef3f..3ddacc6239a3 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -4106,18 +4106,20 @@ static int lan78xx_probe(struct usb_interface *intf, period = ep_intr->desc.bInterval; maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0); buf = kmalloc(maxp, GFP_KERNEL); - if (buf) { - dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL); - if (!dev->urb_intr) { - ret = -ENOMEM; - kfree(buf); - goto out3; - } else { - usb_fill_int_urb(dev->urb_intr, dev->udev, - dev->pipe_intr, buf, maxp, - intr_complete, dev, period); - dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; - } + if (!buf) { + ret = -ENOMEM; + goto out3; + } + + dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL); + if (!dev->urb_intr) { + ret = -ENOMEM; + goto out4; + } else { + usb_fill_int_urb(dev->urb_intr, dev->udev, + dev->pipe_intr, buf, maxp, + intr_complete, dev, period); + dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; } dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); @@ -4125,7 +4127,7 @@ static int lan78xx_probe(struct usb_interface *intf, /* Reject broken descriptors. */ if (dev->maxpacket == 0) { ret = -ENODEV; - goto out4; + goto out5; } /* driver requires remote-wakeup capability during autosuspend. */ @@ -4133,12 +4135,12 @@ static int lan78xx_probe(struct usb_interface *intf, ret = lan78xx_phy_init(dev); if (ret < 0) - goto out4; + goto out5; ret = register_netdev(netdev); if (ret != 0) { netif_err(dev, probe, netdev, "couldn't register the device\n"); - goto out5; + goto out6; } usb_set_intfdata(intf, dev); @@ -4153,10 +4155,12 @@ static int lan78xx_probe(struct usb_interface *intf, return 0; -out5: +out6: phy_disconnect(netdev->phydev); -out4: +out5: usb_free_urb(dev->urb_intr); +out4: + kfree(buf); out3: lan78xx_unbind(dev, intf); out2: -- cgit v1.2.3-59-g8ed1b