diff options
| author | Marian Chereji <marian.chereji@freescale.com> | 2014-09-16 08:59:18 (GMT) |
|---|---|---|
| committer | Matthew Weigel <Matthew.Weigel@freescale.com> | 2014-12-11 18:39:36 (GMT) |
| commit | 316d727c7e81a95d2f27e83a7002933e53c059ed (patch) | |
| tree | dd7c9009c27d191623efee5bef62cdd9133d6ae4 /drivers/staging | |
| parent | 17f24f450c3c3d93c1bea3481bba3fadc1afc1df (diff) | |
| download | linux-fsl-qoriq-316d727c7e81a95d2f27e83a7002933e53c059ed.tar.xz | |
dpa_offload: Avoid dereferencing an invalid pointer
In function "dpa_classif_mcast_create_group" from the dpa_classifier
driver there is a danger of dereferencing pgroup->entries pointer which
can be NULL in case of an error. To avoid this, in case of error this
pointer is checked before using it to release resources. Also, in
order to keep consistency of pgroup->entries in case of an allocation
error of pgroup->member_ids, the allocation of this structure and the
allocation of pgroup->member_ids have swicthed places.
Change-Id: I3d7ec1b01983a9c917f54d596e35afd8ab3539cc
Signed-off-by: Marian Chereji <marian.chereji@freescale.com>
Reviewed-on: http://git.am.freescale.net:8181/18808
Reviewed-by: Radu-Andrei Bulie <Radu.Bulie@freescale.com>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/fsl_dpa_offload/dpa_classifier.c | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/drivers/staging/fsl_dpa_offload/dpa_classifier.c b/drivers/staging/fsl_dpa_offload/dpa_classifier.c index f9f43f6..f4760fa 100644 --- a/drivers/staging/fsl_dpa_offload/dpa_classifier.c +++ b/drivers/staging/fsl_dpa_offload/dpa_classifier.c @@ -7787,23 +7787,22 @@ int dpa_classif_mcast_create_group( sizeof(struct dpa_cls_mcast_group_params)); /* - * initialize the array of used members + * initialize the array of indexes of used members */ - pgroup->entries = kzalloc(sizeof(struct members) * max_members, - GFP_KERNEL); - if (!pgroup->entries) { - log_err("No more memory for DPA multicast member entries.\n"); + pgroup->member_ids = kzalloc(sizeof(int) * max_members, GFP_KERNEL); + if (!pgroup->member_ids) { + log_err("No more memory for DPA multicast index members array.\n"); err = -ENOMEM; goto dpa_classif_mcast_create_group_error; } /* - * initialize the array of indexes of used members + * initialize the array of used members */ - pgroup->member_ids = kzalloc(sizeof(int) * max_members, GFP_KERNEL); - if (!pgroup->member_ids) { - log_err("No more memory for DPA multicast index members " - "array.\n"); + pgroup->entries = kzalloc(sizeof(struct members) * max_members, + GFP_KERNEL); + if (!pgroup->entries) { + log_err("No more memory for DPA multicast member entries.\n"); err = -ENOMEM; goto dpa_classif_mcast_create_group_error; } @@ -7956,8 +7955,10 @@ int dpa_classif_mcast_create_group( dpa_classif_mcast_create_group_error: if (pgroup) { - dpa_classif_hm_release_chain(pgroup->entries[0].hmd); - kfree(pgroup->entries); + if (pgroup->entries) { + dpa_classif_hm_release_chain(pgroup->entries[0].hmd); + kfree(pgroup->entries); + } kfree(pgroup->member_ids); mutex_destroy(&pgroup->access); if (*grpd != DPA_OFFLD_DESC_NONE) { |