tree: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
head: 2a7ede540785cac631a7e7334701a25e949853a8
commit: d08e973a77d128b25e01a08c34d89593fdf222da [756/758] can: gs_usb: Added
support for the GS_USB CAN devices
drivers/net/can/usb/gs_usb.c:830 gs_destroy_candev() error: dereferencing freed
memory 'dev'
drivers/net/can/usb/gs_usb.c:903 gs_usb_probe() error: potential null
dereference 'dev'. (kzalloc returns null)
git remote add net-next
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
git remote update net-next
git checkout d08e973a77d128b25e01a08c34d89593fdf222da
vim +/dev +830 drivers/net/can/usb/gs_usb.c
d08e973a Maximilian Schneider 2013-12-24 824
d08e973a Maximilian Schneider 2013-12-24 825 static void
gs_destroy_candev(struct gs_can *dev)
d08e973a Maximilian Schneider 2013-12-24 826 {
d08e973a Maximilian Schneider 2013-12-24 827 unregister_candev(dev->netdev);
d08e973a Maximilian Schneider 2013-12-24 828 free_candev(dev->netdev);
d08e973a Maximilian Schneider 2013-12-24 829 kfree(dev);
d08e973a Maximilian Schneider 2013-12-24 @830
usb_kill_anchored_urbs(&dev->tx_submitted);
d08e973a Maximilian Schneider 2013-12-24 831 }
d08e973a Maximilian Schneider 2013-12-24 832
d08e973a Maximilian Schneider 2013-12-24 833 static int gs_usb_probe(struct
usb_interface *intf, const struct usb_device_id *id)
d08e973a Maximilian Schneider 2013-12-24 834 {
d08e973a Maximilian Schneider 2013-12-24 835 struct gs_usb *dev;
d08e973a Maximilian Schneider 2013-12-24 836 int rc = -ENOMEM;
d08e973a Maximilian Schneider 2013-12-24 837 unsigned int icount, i;
d08e973a Maximilian Schneider 2013-12-24 838 struct gs_host_config *hconf;
d08e973a Maximilian Schneider 2013-12-24 839 struct gs_device_config *dconf;
d08e973a Maximilian Schneider 2013-12-24 840
d08e973a Maximilian Schneider 2013-12-24 841 hconf = kmalloc(sizeof(*hconf),
GFP_KERNEL);
d08e973a Maximilian Schneider 2013-12-24 842 if (!hconf)
d08e973a Maximilian Schneider 2013-12-24 843 return -ENOMEM;
d08e973a Maximilian Schneider 2013-12-24 844
d08e973a Maximilian Schneider 2013-12-24 845 hconf->byte_order = 0x0000beef;
d08e973a Maximilian Schneider 2013-12-24 846
d08e973a Maximilian Schneider 2013-12-24 847 /* send host config */
d08e973a Maximilian Schneider 2013-12-24 848 rc =
usb_control_msg(interface_to_usbdev(intf),
d08e973a Maximilian Schneider 2013-12-24 849
usb_sndctrlpipe(interface_to_usbdev(intf), 0),
d08e973a Maximilian Schneider 2013-12-24 850
GS_USB_BREQ_HOST_FORMAT,
d08e973a Maximilian Schneider 2013-12-24 851
USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
d08e973a Maximilian Schneider 2013-12-24 852 1,
d08e973a Maximilian Schneider 2013-12-24 853
intf->altsetting[0].desc.bInterfaceNumber,
d08e973a Maximilian Schneider 2013-12-24 854 hconf,
d08e973a Maximilian Schneider 2013-12-24 855
sizeof(*hconf),
d08e973a Maximilian Schneider 2013-12-24 856 1000);
d08e973a Maximilian Schneider 2013-12-24 857
d08e973a Maximilian Schneider 2013-12-24 858 kfree(hconf);
d08e973a Maximilian Schneider 2013-12-24 859
d08e973a Maximilian Schneider 2013-12-24 860 if (rc < 0) {
d08e973a Maximilian Schneider 2013-12-24 861 dev_err(&intf->dev,
"Couldn't send data format (err=%d)\n",
d08e973a Maximilian Schneider 2013-12-24 862 rc);
d08e973a Maximilian Schneider 2013-12-24 863 return rc;
d08e973a Maximilian Schneider 2013-12-24 864 }
d08e973a Maximilian Schneider 2013-12-24 865
d08e973a Maximilian Schneider 2013-12-24 866 dconf = kmalloc(sizeof(*dconf),
GFP_KERNEL);
d08e973a Maximilian Schneider 2013-12-24 867 if (!dconf)
d08e973a Maximilian Schneider 2013-12-24 868 return -ENOMEM;
d08e973a Maximilian Schneider 2013-12-24 869
d08e973a Maximilian Schneider 2013-12-24 870 /* read device config */
d08e973a Maximilian Schneider 2013-12-24 871 rc =
usb_control_msg(interface_to_usbdev(intf),
d08e973a Maximilian Schneider 2013-12-24 872
usb_rcvctrlpipe(interface_to_usbdev(intf), 0),
d08e973a Maximilian Schneider 2013-12-24 873
GS_USB_BREQ_DEVICE_CONFIG,
d08e973a Maximilian Schneider 2013-12-24 874
USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
d08e973a Maximilian Schneider 2013-12-24 875 1,
d08e973a Maximilian Schneider 2013-12-24 876
intf->altsetting[0].desc.bInterfaceNumber,
d08e973a Maximilian Schneider 2013-12-24 877 dconf,
d08e973a Maximilian Schneider 2013-12-24 878
sizeof(*dconf),
d08e973a Maximilian Schneider 2013-12-24 879 1000);
d08e973a Maximilian Schneider 2013-12-24 880 if (rc < 0) {
d08e973a Maximilian Schneider 2013-12-24 881 dev_err(&intf->dev,
"Couldn't get device config: (err=%d)\n",
d08e973a Maximilian Schneider 2013-12-24 882 rc);
d08e973a Maximilian Schneider 2013-12-24 883
d08e973a Maximilian Schneider 2013-12-24 884 kfree(dconf);
d08e973a Maximilian Schneider 2013-12-24 885
d08e973a Maximilian Schneider 2013-12-24 886 return rc;
d08e973a Maximilian Schneider 2013-12-24 887 }
d08e973a Maximilian Schneider 2013-12-24 888
d08e973a Maximilian Schneider 2013-12-24 889 icount = dconf->icount+1;
d08e973a Maximilian Schneider 2013-12-24 890
d08e973a Maximilian Schneider 2013-12-24 891 kfree(dconf);
d08e973a Maximilian Schneider 2013-12-24 892
d08e973a Maximilian Schneider 2013-12-24 893 dev_info(&intf->dev,
"Configuring for %d interfaces\n", icount);
d08e973a Maximilian Schneider 2013-12-24 894
d08e973a Maximilian Schneider 2013-12-24 895 if (icount > GS_MAX_INTF) {
d08e973a Maximilian Schneider 2013-12-24 896 dev_err(&intf->dev,
d08e973a Maximilian Schneider 2013-12-24 897 "Driver cannot
handle more that %d CAN interfaces\n",
d08e973a Maximilian Schneider 2013-12-24 898 GS_MAX_INTF);
d08e973a Maximilian Schneider 2013-12-24 899 return -EINVAL;
d08e973a Maximilian Schneider 2013-12-24 900 }
d08e973a Maximilian Schneider 2013-12-24 901
d08e973a Maximilian Schneider 2013-12-24 902 dev = kzalloc(sizeof(*dev),
GFP_KERNEL);
d08e973a Maximilian Schneider 2013-12-24 @903
init_usb_anchor(&dev->rx_submitted);
d08e973a Maximilian Schneider 2013-12-24 904
d08e973a Maximilian Schneider 2013-12-24 905
atomic_set(&dev->active_channels, 0);
d08e973a Maximilian Schneider 2013-12-24 906
---
0-DAY kernel build testing backend Open Source Technology Center
http://lists.01.org/mailman/listinfo/kbuild Intel Corporation
_______________________________________________
kbuild mailing list
kbuild@lists.01.org
https://lists.01.org/mailman/listinfo/kbuild
