aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net
diff options
context:
space:
mode:
authorAlexey Khoroshilov <khoroshilov@ispras.ru>2012-08-08 11:15:01 -0400
committerMarc Kleine-Budde <mkl@pengutronix.de>2012-08-24 04:54:05 -0400
commitef813c412c0cf254ddce7d922289e2d6a69960f0 (patch)
tree97545ead4ddca18f1e1fe2c1896439a24b530c23 /drivers/net
parenta0dfb2634e5671770f598cda08002d8cda66ac77 (diff)
can: softing: Fix potential memory leak in softing_load_fw()
Do not leak memory by updating pointer with potentially NULL realloc return value. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/can/softing/softing_fw.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c
index 310596175676..b595d3422b9f 100644
--- a/drivers/net/can/softing/softing_fw.c
+++ b/drivers/net/can/softing/softing_fw.c
@@ -150,7 +150,7 @@ int softing_load_fw(const char *file, struct softing *card,
150 const uint8_t *mem, *end, *dat; 150 const uint8_t *mem, *end, *dat;
151 uint16_t type, len; 151 uint16_t type, len;
152 uint32_t addr; 152 uint32_t addr;
153 uint8_t *buf = NULL; 153 uint8_t *buf = NULL, *new_buf;
154 int buflen = 0; 154 int buflen = 0;
155 int8_t type_end = 0; 155 int8_t type_end = 0;
156 156
@@ -199,11 +199,12 @@ int softing_load_fw(const char *file, struct softing *card,
199 if (len > buflen) { 199 if (len > buflen) {
200 /* align buflen */ 200 /* align buflen */
201 buflen = (len + (1024-1)) & ~(1024-1); 201 buflen = (len + (1024-1)) & ~(1024-1);
202 buf = krealloc(buf, buflen, GFP_KERNEL); 202 new_buf = krealloc(buf, buflen, GFP_KERNEL);
203 if (!buf) { 203 if (!new_buf) {
204 ret = -ENOMEM; 204 ret = -ENOMEM;
205 goto failed; 205 goto failed;
206 } 206 }
207 buf = new_buf;
207 } 208 }
208 /* verify record data */ 209 /* verify record data */
209 memcpy_fromio(buf, &dpram[addr + offset], len); 210 memcpy_fromio(buf, &dpram[addr + offset], len);