tree: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master head: 2a7ede540785cac631a7e7334701a25e949853a8 commit: d08e973a77d128b25e01a08c34d89593fdf222da [756/758] can: gs_usb: Added support for the GS_USB CAN devices
drivers/net/can/usb/gs_usb.c:830 gs_destroy_candev() error: dereferencing freed memory 'dev' drivers/net/can/usb/gs_usb.c:903 gs_usb_probe() error: potential null dereference 'dev'. (kzalloc returns null) git remote add net-next git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git git remote update net-next git checkout d08e973a77d128b25e01a08c34d89593fdf222da vim +/dev +830 drivers/net/can/usb/gs_usb.c d08e973a Maximilian Schneider 2013-12-24 824 d08e973a Maximilian Schneider 2013-12-24 825 static void gs_destroy_candev(struct gs_can *dev) d08e973a Maximilian Schneider 2013-12-24 826 { d08e973a Maximilian Schneider 2013-12-24 827 unregister_candev(dev->netdev); d08e973a Maximilian Schneider 2013-12-24 828 free_candev(dev->netdev); d08e973a Maximilian Schneider 2013-12-24 829 kfree(dev); d08e973a Maximilian Schneider 2013-12-24 @830 usb_kill_anchored_urbs(&dev->tx_submitted); d08e973a Maximilian Schneider 2013-12-24 831 } d08e973a Maximilian Schneider 2013-12-24 832 d08e973a Maximilian Schneider 2013-12-24 833 static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) d08e973a Maximilian Schneider 2013-12-24 834 { d08e973a Maximilian Schneider 2013-12-24 835 struct gs_usb *dev; d08e973a Maximilian Schneider 2013-12-24 836 int rc = -ENOMEM; d08e973a Maximilian Schneider 2013-12-24 837 unsigned int icount, i; d08e973a Maximilian Schneider 2013-12-24 838 struct gs_host_config *hconf; d08e973a Maximilian Schneider 2013-12-24 839 struct gs_device_config *dconf; d08e973a Maximilian Schneider 2013-12-24 840 d08e973a Maximilian Schneider 2013-12-24 841 hconf = kmalloc(sizeof(*hconf), GFP_KERNEL); d08e973a Maximilian Schneider 2013-12-24 842 if (!hconf) d08e973a Maximilian Schneider 2013-12-24 843 return -ENOMEM; d08e973a Maximilian Schneider 2013-12-24 844 d08e973a Maximilian Schneider 2013-12-24 845 hconf->byte_order = 0x0000beef; d08e973a Maximilian Schneider 2013-12-24 846 d08e973a Maximilian Schneider 2013-12-24 847 /* send host config */ d08e973a Maximilian Schneider 2013-12-24 848 rc = usb_control_msg(interface_to_usbdev(intf), d08e973a Maximilian Schneider 2013-12-24 849 usb_sndctrlpipe(interface_to_usbdev(intf), 0), d08e973a Maximilian Schneider 2013-12-24 850 GS_USB_BREQ_HOST_FORMAT, d08e973a Maximilian Schneider 2013-12-24 851 USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, d08e973a Maximilian Schneider 2013-12-24 852 1, d08e973a Maximilian Schneider 2013-12-24 853 intf->altsetting[0].desc.bInterfaceNumber, d08e973a Maximilian Schneider 2013-12-24 854 hconf, d08e973a Maximilian Schneider 2013-12-24 855 sizeof(*hconf), d08e973a Maximilian Schneider 2013-12-24 856 1000); d08e973a Maximilian Schneider 2013-12-24 857 d08e973a Maximilian Schneider 2013-12-24 858 kfree(hconf); d08e973a Maximilian Schneider 2013-12-24 859 d08e973a Maximilian Schneider 2013-12-24 860 if (rc < 0) { d08e973a Maximilian Schneider 2013-12-24 861 dev_err(&intf->dev, "Couldn't send data format (err=%d)\n", d08e973a Maximilian Schneider 2013-12-24 862 rc); d08e973a Maximilian Schneider 2013-12-24 863 return rc; d08e973a Maximilian Schneider 2013-12-24 864 } d08e973a Maximilian Schneider 2013-12-24 865 d08e973a Maximilian Schneider 2013-12-24 866 dconf = kmalloc(sizeof(*dconf), GFP_KERNEL); d08e973a Maximilian Schneider 2013-12-24 867 if (!dconf) d08e973a Maximilian Schneider 2013-12-24 868 return -ENOMEM; d08e973a Maximilian Schneider 2013-12-24 869 d08e973a Maximilian Schneider 2013-12-24 870 /* read device config */ d08e973a Maximilian Schneider 2013-12-24 871 rc = usb_control_msg(interface_to_usbdev(intf), d08e973a Maximilian Schneider 2013-12-24 872 usb_rcvctrlpipe(interface_to_usbdev(intf), 0), d08e973a Maximilian Schneider 2013-12-24 873 GS_USB_BREQ_DEVICE_CONFIG, d08e973a Maximilian Schneider 2013-12-24 874 USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, d08e973a Maximilian Schneider 2013-12-24 875 1, d08e973a Maximilian Schneider 2013-12-24 876 intf->altsetting[0].desc.bInterfaceNumber, d08e973a Maximilian Schneider 2013-12-24 877 dconf, d08e973a Maximilian Schneider 2013-12-24 878 sizeof(*dconf), d08e973a Maximilian Schneider 2013-12-24 879 1000); d08e973a Maximilian Schneider 2013-12-24 880 if (rc < 0) { d08e973a Maximilian Schneider 2013-12-24 881 dev_err(&intf->dev, "Couldn't get device config: (err=%d)\n", d08e973a Maximilian Schneider 2013-12-24 882 rc); d08e973a Maximilian Schneider 2013-12-24 883 d08e973a Maximilian Schneider 2013-12-24 884 kfree(dconf); d08e973a Maximilian Schneider 2013-12-24 885 d08e973a Maximilian Schneider 2013-12-24 886 return rc; d08e973a Maximilian Schneider 2013-12-24 887 } d08e973a Maximilian Schneider 2013-12-24 888 d08e973a Maximilian Schneider 2013-12-24 889 icount = dconf->icount+1; d08e973a Maximilian Schneider 2013-12-24 890 d08e973a Maximilian Schneider 2013-12-24 891 kfree(dconf); d08e973a Maximilian Schneider 2013-12-24 892 d08e973a Maximilian Schneider 2013-12-24 893 dev_info(&intf->dev, "Configuring for %d interfaces\n", icount); d08e973a Maximilian Schneider 2013-12-24 894 d08e973a Maximilian Schneider 2013-12-24 895 if (icount > GS_MAX_INTF) { d08e973a Maximilian Schneider 2013-12-24 896 dev_err(&intf->dev, d08e973a Maximilian Schneider 2013-12-24 897 "Driver cannot handle more that %d CAN interfaces\n", d08e973a Maximilian Schneider 2013-12-24 898 GS_MAX_INTF); d08e973a Maximilian Schneider 2013-12-24 899 return -EINVAL; d08e973a Maximilian Schneider 2013-12-24 900 } d08e973a Maximilian Schneider 2013-12-24 901 d08e973a Maximilian Schneider 2013-12-24 902 dev = kzalloc(sizeof(*dev), GFP_KERNEL); d08e973a Maximilian Schneider 2013-12-24 @903 init_usb_anchor(&dev->rx_submitted); d08e973a Maximilian Schneider 2013-12-24 904 d08e973a Maximilian Schneider 2013-12-24 905 atomic_set(&dev->active_channels, 0); d08e973a Maximilian Schneider 2013-12-24 906 --- 0-DAY kernel build testing backend Open Source Technology Center http://lists.01.org/mailman/listinfo/kbuild Intel Corporation _______________________________________________ kbuild mailing list kbuild@lists.01.org https://lists.01.org/mailman/listinfo/kbuild