[PATCH] staging: vt6655: check returned value from kzalloc

[Pierre-Yves Kerbrat]

Return value from kzalloc was not checked in
device_init_td*_ring before using it.

Signed-off-by: Pierre-Yves Kerbrat <pkerb...@free.fr>
---
 drivers/staging/vt6655/device_main.c | 43 ++++++++++++++++++++++++------------
 1 file changed, 29 insertions(+), 14 deletions(-)

diff --git a/drivers/staging/vt6655/device_main.c 
b/drivers/staging/vt6655/device_main.c
index 1123b4f1e1d6..cf3259adde84 100644
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -630,16 +630,24 @@ static void device_init_td0_ring(struct vnt_private *priv)
             i++, curr += sizeof(struct vnt_tx_desc)) {
                desc = &priv->apTD0Rings[i];
                desc->td_info = kzalloc(sizeof(*desc->td_info), GFP_ATOMIC);
-
-               desc->td_info->buf = priv->tx0_bufs + i * PKT_BUF_SZ;
-               desc->td_info->buf_dma = priv->tx_bufs_dma0 + i * PKT_BUF_SZ;
-
-               desc->next = &(priv->apTD0Rings[(i+1) % 
priv->opts.tx_descs[0]]);
-               desc->next_desc = cpu_to_le32(curr + sizeof(struct 
vnt_tx_desc));
+               if (desc->td_info) {
+                       desc->td_info->buf = priv->tx0_bufs +
+                               i * PKT_BUF_SZ;
+                       desc->td_info->buf_dma = priv->tx_bufs_dma0 +
+                               i * PKT_BUF_SZ;
+
+                       desc->next = &(priv->apTD0Rings[(i + 1) %
+                                       priv->opts.tx_descs[0]]);
+                       desc->next_desc = cpu_to_le32(curr +
+                                       sizeof(struct vnt_tx_desc));
+               } else {
+                       dev_err(&priv->pcid->dev, "Can not allocate td_info\n");
+               }
        }
 
        if (i > 0)
-               priv->apTD0Rings[i-1].next_desc = 
cpu_to_le32(priv->td0_pool_dma);
+               priv->apTD0Rings[i - 1].next_desc =
+                       cpu_to_le32(priv->td0_pool_dma);
        priv->apTailTD[0] = priv->apCurrTD[0] = &priv->apTD0Rings[0];
 }
 
@@ -655,16 +663,23 @@ static void device_init_td1_ring(struct vnt_private *priv)
             i++, curr += sizeof(struct vnt_tx_desc)) {
                desc = &priv->apTD1Rings[i];
                desc->td_info = kzalloc(sizeof(*desc->td_info), GFP_ATOMIC);
-
-               desc->td_info->buf = priv->tx1_bufs + i * PKT_BUF_SZ;
-               desc->td_info->buf_dma = priv->tx_bufs_dma1 + i * PKT_BUF_SZ;
-
-               desc->next = &(priv->apTD1Rings[(i + 1) % 
priv->opts.tx_descs[1]]);
-               desc->next_desc = cpu_to_le32(curr + sizeof(struct 
vnt_tx_desc));
+               if (desc->td_info) {
+                       desc->td_info->buf = priv->tx1_bufs + i * PKT_BUF_SZ;
+                       desc->td_info->buf_dma = priv->tx_bufs_dma1 +
+                                       i * PKT_BUF_SZ;
+
+                       desc->next = &(priv->apTD1Rings[(i + 1) %
+                                       priv->opts.tx_descs[1]]);
+                       desc->next_desc = cpu_to_le32(curr +
+                                       sizeof(struct vnt_tx_desc));
+               } else {
+                       dev_err(&priv->pcid->dev, "Can not allocate td_info\n");
+               }
        }
 
        if (i > 0)
-               priv->apTD1Rings[i-1].next_desc = 
cpu_to_le32(priv->td1_pool_dma);
+               priv->apTD1Rings[i - 1].next_desc =
+                       cpu_to_le32(priv->td1_pool_dma);
        priv->apTailTD[1] = priv->apCurrTD[1] = &priv->apTD1Rings[0];
 }
 
-- 
2.11.0

_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel