From e42d50baf43120a78985f13f6e9c8f92fae091c2 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Wed, 19 Jun 2013 19:01:01 +0300 Subject: FMC: NULL dereference on allocation failure If we don't allocate "arr" then the cleanup path will dereference it and oops. Signed-off-by: Dan Carpenter Acked-by: Alessandro Rubini Signed-off-by: Greg Kroah-Hartman --- drivers/fmc/fmc-sdb.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'drivers/fmc') diff --git a/drivers/fmc/fmc-sdb.c b/drivers/fmc/fmc-sdb.c index 74fb326f4af1..79adc39221ea 100644 --- a/drivers/fmc/fmc-sdb.c +++ b/drivers/fmc/fmc-sdb.c @@ -46,16 +46,17 @@ static struct sdb_array *__fmc_scan_sdb_tree(struct fmc_device *fmc, onew = __sdb_rd(fmc, sdb_addr + 4, convert); n = __be16_to_cpu(*(uint16_t *)&onew); arr = kzalloc(sizeof(*arr), GFP_KERNEL); - if (arr) { - arr->record = kzalloc(sizeof(arr->record[0]) * n, GFP_KERNEL); - arr->subtree = kzalloc(sizeof(arr->subtree[0]) * n, GFP_KERNEL); - } - if (!arr || !arr->record || !arr->subtree) { + if (!arr) + return ERR_PTR(-ENOMEM); + arr->record = kzalloc(sizeof(arr->record[0]) * n, GFP_KERNEL); + arr->subtree = kzalloc(sizeof(arr->subtree[0]) * n, GFP_KERNEL); + if (!arr->record || !arr->subtree) { kfree(arr->record); kfree(arr->subtree); kfree(arr); return ERR_PTR(-ENOMEM); } + arr->len = n; arr->level = level; arr->fmc = fmc; -- cgit v1.2.3