Messages in this thread Patch in this message | | | From | Jia-Ju Bai <> | Subject | [PATCH] ath6kl: Fix a possible null-pointer dereference in ath6kl_htc_mbox_create() | Date | Mon, 29 Jul 2019 11:03:05 +0800 |
| |
In ath6kl_htc_mbox_create(), when kzalloc() on line 2855 fails, target->dev is assigned to NULL, and ath6kl_htc_mbox_cleanup(target) is called on line 2885.
In ath6kl_htc_mbox_cleanup(), target->dev is used on line 2895: ath6kl_hif_cleanup_scatter(target->dev->ar);
Thus, a null-pointer dereference may occur.
To fix this bug, kfree(target) is called and NULL is returned when kzalloc() on line 2855 fails.
This bug is found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> --- drivers/net/wireless/ath/ath6kl/htc_mbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/htc_mbox.c b/drivers/net/wireless/ath/ath6kl/htc_mbox.c index 65c31da43c47..998947ef63b6 100644 --- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c +++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c @@ -2855,8 +2855,8 @@ static void *ath6kl_htc_mbox_create(struct ath6kl *ar) target->dev = kzalloc(sizeof(*target->dev), GFP_KERNEL); if (!target->dev) { ath6kl_err("unable to allocate memory\n"); - status = -ENOMEM; - goto err_htc_cleanup; + kfree(target); + return NULL; } spin_lock_init(&target->htc_lock); -- 2.17.0
| |