diff options
author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2012-08-08 11:15:01 -0400 |
---|---|---|
committer | Marc Kleine-Budde <mkl@pengutronix.de> | 2012-08-24 04:54:05 -0400 |
commit | ef813c412c0cf254ddce7d922289e2d6a69960f0 (patch) | |
tree | 97545ead4ddca18f1e1fe2c1896439a24b530c23 /drivers/net | |
parent | a0dfb2634e5671770f598cda08002d8cda66ac77 (diff) |
can: softing: Fix potential memory leak in softing_load_fw()
Do not leak memory by updating pointer with potentially NULL realloc return value.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers/net')
-rw-r--r-- | drivers/net/can/softing/softing_fw.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c index 310596175676..b595d3422b9f 100644 --- a/drivers/net/can/softing/softing_fw.c +++ b/drivers/net/can/softing/softing_fw.c | |||
@@ -150,7 +150,7 @@ int softing_load_fw(const char *file, struct softing *card, | |||
150 | const uint8_t *mem, *end, *dat; | 150 | const uint8_t *mem, *end, *dat; |
151 | uint16_t type, len; | 151 | uint16_t type, len; |
152 | uint32_t addr; | 152 | uint32_t addr; |
153 | uint8_t *buf = NULL; | 153 | uint8_t *buf = NULL, *new_buf; |
154 | int buflen = 0; | 154 | int buflen = 0; |
155 | int8_t type_end = 0; | 155 | int8_t type_end = 0; |
156 | 156 | ||
@@ -199,11 +199,12 @@ int softing_load_fw(const char *file, struct softing *card, | |||
199 | if (len > buflen) { | 199 | if (len > buflen) { |
200 | /* align buflen */ | 200 | /* align buflen */ |
201 | buflen = (len + (1024-1)) & ~(1024-1); | 201 | buflen = (len + (1024-1)) & ~(1024-1); |
202 | buf = krealloc(buf, buflen, GFP_KERNEL); | 202 | new_buf = krealloc(buf, buflen, GFP_KERNEL); |
203 | if (!buf) { | 203 | if (!new_buf) { |
204 | ret = -ENOMEM; | 204 | ret = -ENOMEM; |
205 | goto failed; | 205 | goto failed; |
206 | } | 206 | } |
207 | buf = new_buf; | ||
207 | } | 208 | } |
208 | /* verify record data */ | 209 | /* verify record data */ |
209 | memcpy_fromio(buf, &dpram[addr + offset], len); | 210 | memcpy_fromio(buf, &dpram[addr + offset], len); |