diff options
Diffstat (limited to 'drivers/usb/misc/usbtest.c')
-rw-r--r-- | drivers/usb/misc/usbtest.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c index 959145baf3cf..9dcb68f04f03 100644 --- a/drivers/usb/misc/usbtest.c +++ b/drivers/usb/misc/usbtest.c | |||
@@ -423,7 +423,7 @@ alloc_sglist(int nents, int max, int vary) | |||
423 | unsigned i; | 423 | unsigned i; |
424 | unsigned size = max; | 424 | unsigned size = max; |
425 | 425 | ||
426 | sg = kmalloc(nents * sizeof *sg, GFP_KERNEL); | 426 | sg = kmalloc_array(nents, sizeof *sg, GFP_KERNEL); |
427 | if (!sg) | 427 | if (!sg) |
428 | return NULL; | 428 | return NULL; |
429 | sg_init_table(sg, nents); | 429 | sg_init_table(sg, nents); |
@@ -904,6 +904,9 @@ test_ctrl_queue(struct usbtest_dev *dev, struct usbtest_param *param) | |||
904 | struct ctrl_ctx context; | 904 | struct ctrl_ctx context; |
905 | int i; | 905 | int i; |
906 | 906 | ||
907 | if (param->sglen == 0 || param->iterations > UINT_MAX / param->sglen) | ||
908 | return -EOPNOTSUPP; | ||
909 | |||
907 | spin_lock_init(&context.lock); | 910 | spin_lock_init(&context.lock); |
908 | context.dev = dev; | 911 | context.dev = dev; |
909 | init_completion(&context.complete); | 912 | init_completion(&context.complete); |
@@ -1981,8 +1984,6 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf) | |||
1981 | 1984 | ||
1982 | /* queued control messaging */ | 1985 | /* queued control messaging */ |
1983 | case 10: | 1986 | case 10: |
1984 | if (param->sglen == 0) | ||
1985 | break; | ||
1986 | retval = 0; | 1987 | retval = 0; |
1987 | dev_info(&intf->dev, | 1988 | dev_info(&intf->dev, |
1988 | "TEST 10: queue %d control calls, %d times\n", | 1989 | "TEST 10: queue %d control calls, %d times\n", |
@@ -2276,6 +2277,8 @@ usbtest_probe(struct usb_interface *intf, const struct usb_device_id *id) | |||
2276 | if (status < 0) { | 2277 | if (status < 0) { |
2277 | WARNING(dev, "couldn't get endpoints, %d\n", | 2278 | WARNING(dev, "couldn't get endpoints, %d\n", |
2278 | status); | 2279 | status); |
2280 | kfree(dev->buf); | ||
2281 | kfree(dev); | ||
2279 | return status; | 2282 | return status; |
2280 | } | 2283 | } |
2281 | /* may find bulk or ISO pipes */ | 2284 | /* may find bulk or ISO pipes */ |