gma500: mmu: unmap the correct address

The function kunmap_atomatic() is called on the same variable twice, i.e. pt->v. In the second call, its parameter should be variable v rather than pt->v. Signed-off-by: Pan Bian --- drivers/gpu/drm/gma500/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/g

[V3] firmware: vpd: use memunmap instead of iounmap

In functions vpd_sections_init() and vpd_section_init(), iounmap() is used to unmap memory. However, in these cases, memunmap() should be used. Signed-off-by: Pan Bian <bianpan2...@163.com> --- V2: change error label err_iounmap to err_memunmap V3: add changes from V1 to V2 --- drivers/fi

[V3] firmware: vpd: use memunmap instead of iounmap

In functions vpd_sections_init() and vpd_section_init(), iounmap() is used to unmap memory. However, in these cases, memunmap() should be used. Signed-off-by: Pan Bian --- V2: change error label err_iounmap to err_memunmap V3: add changes from V1 to V2 --- drivers/firmware/google/vpd.c | 10

[V2] kexec_file: use crypto_free_shash to free memory

dropped. Signed-off-by: Pan Bian <bianpan2...@163.com> --- kernel/kexec_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 9f48f44..94eeb38 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -627,7 +627,7 @@ stat

[V2] kexec_file: use crypto_free_shash to free memory

dropped. Signed-off-by: Pan Bian --- kernel/kexec_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 9f48f44..94eeb38 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -627,7 +627,7 @@ static int

[V2] firmware: vpd: use memunmap instead of iounmap

In functions vpd_sections_init() and vpd_section_init(), iounmap() is used to unmap memory. However, in these cases, memunmap() should be used. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/firmware/google/vpd.c | 10 +- 1 file changed, 5 insertions(+), 5 deletions(-)

[V2] firmware: vpd: use memunmap instead of iounmap

In functions vpd_sections_init() and vpd_section_init(), iounmap() is used to unmap memory. However, in these cases, memunmap() should be used. Signed-off-by: Pan Bian --- drivers/firmware/google/vpd.c | 10 +- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers

media: mtk-mdp: use IS_ERR to check return value of of_clk_get

Function of_clk_get() returns an ERR_PTR on failures. In file mtk_mdp_commp.c, its return value is checked against NULL. Such checks cannot prevent from accessing bad memory. This patch replaces the NULL checks with IS_ERR checks. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers

media: mtk-mdp: use IS_ERR to check return value of of_clk_get

Function of_clk_get() returns an ERR_PTR on failures. In file mtk_mdp_commp.c, its return value is checked against NULL. Such checks cannot prevent from accessing bad memory. This patch replaces the NULL checks with IS_ERR checks. Signed-off-by: Pan Bian --- drivers/media/platform/mtk-mdp

mtd: nand: use dma_mapping_error to check map errors

The return value of dma_map_single() should be checked by dma_mapping_error(). However, in function flctl_dma_fifo0_transfer(), its return value is checked against NULL, which could result in failures. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/mtd/nand/sh_flctl.c | 2 +-

mtd: nand: use dma_mapping_error to check map errors

The return value of dma_map_single() should be checked by dma_mapping_error(). However, in function flctl_dma_fifo0_transfer(), its return value is checked against NULL, which could result in failures. Signed-off-by: Pan Bian --- drivers/mtd/nand/sh_flctl.c | 2 +- 1 file changed, 1 insertion

scsi: qla2xxx: use dma_mapping_error to check map errors

The return value of dma_map_single() should be checked by dma_mapping_error(). However, in function qla26xx_dport_diagnostics(), its return value is checked against NULL, which could result in failures. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/scsi/qla2xxx/qla_mbx.c | 2

scsi: qla2xxx: use dma_mapping_error to check map errors

The return value of dma_map_single() should be checked by dma_mapping_error(). However, in function qla26xx_dport_diagnostics(), its return value is checked against NULL, which could result in failures. Signed-off-by: Pan Bian --- drivers/scsi/qla2xxx/qla_mbx.c | 2 +- 1 file changed, 1

crypto: ccp: use dma_mapping_error to check map error

The return value of dma_map_single() should be checked by dma_mapping_error(). However, in function ccp_init_dm_workarea(), its return value is checked against NULL, which could result in failures. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/crypto/ccp/ccp-ops.c | 2 +-

crypto: ccp: use dma_mapping_error to check map error

The return value of dma_map_single() should be checked by dma_mapping_error(). However, in function ccp_init_dm_workarea(), its return value is checked against NULL, which could result in failures. Signed-off-by: Pan Bian --- drivers/crypto/ccp/ccp-ops.c | 2 +- 1 file changed, 1 insertion

xen/9pfs: check return value of xenbus_read correctly

-off-by: Pan Bian <bianpan2...@163.com> --- net/9p/trans_xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 6ad3e04..c548781 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -389,7 +389,7 @@ static int xen_9pfs_front

xen/9pfs: check return value of xenbus_read correctly

-off-by: Pan Bian --- net/9p/trans_xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 6ad3e04..c548781 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -389,7 +389,7 @@ static int xen_9pfs_front_probe(struct xenbus_device

input: touchscreen: mxs-lradc: use correct error check

Function devm_ioremap() will return a NULL pointer on failure. However, in function mxs_lradc_ts_probe(), its return value is checked with IS_ERR(), which cannot detect the exceptional case. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/input/touchscreen/mxs-lradc-ts.c | 4 +

input: touchscreen: mxs-lradc: use correct error check

Function devm_ioremap() will return a NULL pointer on failure. However, in function mxs_lradc_ts_probe(), its return value is checked with IS_ERR(), which cannot detect the exceptional case. Signed-off-by: Pan Bian --- drivers/input/touchscreen/mxs-lradc-ts.c | 4 ++-- 1 file changed, 2

firmware: vpd: use memunmap instead of iounmap

In functions vpd_sections_init() and vpd_section_init(), iounmap() is used to unmap memory. However, in these cases, memunmap() is better. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/firmware/google/vpd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff

firmware: vpd: use memunmap instead of iounmap

In functions vpd_sections_init() and vpd_section_init(), iounmap() is used to unmap memory. However, in these cases, memunmap() is better. Signed-off-by: Pan Bian --- drivers/firmware/google/vpd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/google

kexec_file: use crypto_free_shash to free memory

In function kexec_calculate_store_digests(), kfree() is used to free memory allocated by crypto_alloc_shash(). It is better to use function crypto_free_shash(), which also zeroizes the memory to be freed. Signed-off-by: Pan Bian <bianpan2...@163.com> --- kernel/kexec_file.c | 2 +-

kexec_file: use crypto_free_shash to free memory

In function kexec_calculate_store_digests(), kfree() is used to free memory allocated by crypto_alloc_shash(). It is better to use function crypto_free_shash(), which also zeroizes the memory to be freed. Signed-off-by: Pan Bian --- kernel/kexec_file.c | 2 +- 1 file changed, 1 insertion(+), 1

xfs: use kmem_free to free return value of kmem_zalloc

In function xfs_test_remount_options(), kfree() is used to free memory allocated by kmem_zalloc(). But it is better to use kmem_free(). Signed-off-by: Pan Bian <bianpan2...@163.com> --- fs/xfs/xfs_super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/xfs_super.

xfs: use kmem_free to free return value of kmem_zalloc

In function xfs_test_remount_options(), kfree() is used to free memory allocated by kmem_zalloc(). But it is better to use kmem_free(). Signed-off-by: Pan Bian --- fs/xfs/xfs_super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c

scsi: mvsas: replace kfree with scsi_host_put

The return value of scsi_host_alloc() should be released by scsi_host_put(). However, in function mvs_pci_init(), kfree() is used. This patch replaces kfree() with scsi_host_put() to avoid possible memory leaks. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/scsi/mvsas/mv_init

scsi: mvsas: replace kfree with scsi_host_put

The return value of scsi_host_alloc() should be released by scsi_host_put(). However, in function mvs_pci_init(), kfree() is used. This patch replaces kfree() with scsi_host_put() to avoid possible memory leaks. Signed-off-by: Pan Bian --- drivers/scsi/mvsas/mv_init.c | 4 ++-- 1 file changed

scsi: pm8001: fix double free in pm8001_pci_probe

shost again, resulting in a double free bug. This patch removes scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put() to release Scsi_Host in need. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/scsi/pm8001/pm8001_init.c | 5 ++--- 1 file changed, 2 insertions

scsi: pm8001: fix double free in pm8001_pci_probe

shost again, resulting in a double free bug. This patch removes scsi_host_put() from pm8001_free() and explicitly calls scsi_host_put() to release Scsi_Host in need. Signed-off-by: Pan Bian --- drivers/scsi/pm8001/pm8001_init.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff

scsi: hisi_sas: replace kfree with scsi_host_put

Return value of scsi_host_alloc() should be released with scsi_host_put() rather than kfree(). Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_

scsi: hisi_sas: replace kfree with scsi_host_put

Return value of scsi_host_alloc() should be released with scsi_host_put() rather than kfree(). Signed-off-by: Pan Bian --- drivers/scsi/hisi_sas/hisi_sas_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi

[PATCH net] team: fix memory leaks

sages for options transfers") Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/net/team/team.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index f8c81f1..85c0124 100644 --- a/drivers/net/team/team.c +

[PATCH net] team: fix memory leaks

sages for options transfers") Signed-off-by: Pan Bian --- drivers/net/team/team.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index f8c81f1..85c0124 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/t

[net 1/1] team: fix memory leaks

sages for options transfers") Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/net/team/team.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index f8c81f1..85c0124 100644 --- a/drivers/net/team/team.c +

[net 1/1] team: fix memory leaks

sages for options transfers") Signed-off-by: Pan Bian --- drivers/net/team/team.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index f8c81f1..85c0124 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c

[PATCH 1/1] drm/radeon: check return value of radeon_fence_emit

From: Pan Bian <bianpan2...@163.com> Function radeon_fence_emit() returns -ENOMEM if there is no enough memory. And in this case, function radeon_ring_unlock_undo() rather than function radeon_ring_unlock_commit() should be called. However, in function radeon_test_create_and_emit

[PATCH 1/1] drm/radeon: check return value of radeon_fence_emit

From: Pan Bian Function radeon_fence_emit() returns -ENOMEM if there is no enough memory. And in this case, function radeon_ring_unlock_undo() rather than function radeon_ring_unlock_commit() should be called. However, in function radeon_test_create_and_emit_fence(), the return value

[PATCH 1/1] drm/radeon: check return value of radeon_ring_lock

From: Pan Bian <bianpan2...@163.com> Function radeon_ring_lock() returns an errno on failure, and its return value should be validated. However, in functions r420_cp_errata_init() and r420_cp_errata_fini(), its return value is not checked. This patch adds the checks. Signed-off-by: Pa

[PATCH 1/1] drm/radeon: check return value of radeon_ring_lock

From: Pan Bian Function radeon_ring_lock() returns an errno on failure, and its return value should be validated. However, in functions r420_cp_errata_init() and r420_cp_errata_fini(), its return value is not checked. This patch adds the checks. Signed-off-by: Pan Bian --- drivers/gpu/drm

[PATCH 1/1] power: Fix unchecked return value of devm_kzalloc

Function devm_kzalloc() will return a NULL pointer. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is directly used without validation. This may result in a bad memory access bug. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/power/

[PATCH 1/1] power: Fix unchecked return value of devm_kzalloc

Function devm_kzalloc() will return a NULL pointer. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is directly used without validation. This may result in a bad memory access bug. Signed-off-by: Pan Bian --- drivers/power/supply/isp1704_charger.c | 4 1

[PATCH 1/2] net: team: fix memory leak in team_nl_send_port_list_get

In function team_nl_send_port_list_get(), pointer skb keeps the return value of nlmsg_new(). When the call to genlmsg_put() fails, the memory is not freed. This will result in a memory leak bug. This patch fixes it. Fixes: fbd69cda90e7 ("team: fix memory leak") Signed-off-by: Pan Bian

[PATCH 1/2] net: team: fix memory leak in team_nl_send_port_list_get

In function team_nl_send_port_list_get(), pointer skb keeps the return value of nlmsg_new(). When the call to genlmsg_put() fails, the memory is not freed. This will result in a memory leak bug. This patch fixes it. Fixes: fbd69cda90e7 ("team: fix memory leak") Signed-off-by

[PATCH 2/2] net: team: fix memory leak in team_nl_send_options_get

emory leak") Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/net/team/team.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index dd3a2e9..85c0124 100644 --- a/drivers/net/team/team.c +++ b/drivers

[PATCH 2/2] net: team: fix memory leak in team_nl_send_options_get

emory leak") Signed-off-by: Pan Bian --- drivers/net/team/team.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index dd3a2e9..85c0124 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2361,8 +2361,10

[PATCH 1/1] rndis_wlan: add return value validation

From: Pan Bian <bianpan2...@163.com> Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its return value is not checked. This may cause NULL deref

[PATCH 1/1] rndis_wlan: add return value validation

From: Pan Bian Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its return value is not checked. This may cause NULL dereference bugs. This patch fixes

[PATCH 1/1] power: Fix unchecked return value of devm_kzalloc

Function devm_kzalloc() will return a NULL pointer. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is directly used without validation. This may result in a bad memory access bug. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/power/

[PATCH 1/1] power: Fix unchecked return value of devm_kzalloc

Function devm_kzalloc() will return a NULL pointer. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is directly used without validation. This may result in a bad memory access bug. Signed-off-by: Pan Bian --- drivers/power/supply/isp1704_charger.c | 2 ++ 1 file

[PATCH 1/1] PCI: check return value of pci_find_ext_capability

From: Pan Bian <bianpan2...@163.com> Function pci_find_ext_capability() will returns 0 on failure, and its return value should be checked before it is used. However, in function pcie_port_enable_msix(), its return value is not checked. This patch adds the check. Signed-off-by: Pan Bian <

[PATCH 1/1] PCI: check return value of pci_find_ext_capability

From: Pan Bian Function pci_find_ext_capability() will returns 0 on failure, and its return value should be checked before it is used. However, in function pcie_port_enable_msix(), its return value is not checked. This patch adds the check. Signed-off-by: Pan Bian --- drivers/pci/pcie

[PATCH 1/1] drm/radeon: check return vlaue of radeon_fence_emit

From: Pan Bian <bianpan2...@163.com> Function radeon_fence_emit() returns -ENOMEM if there is no enough memory. And in this case, function radeon_ring_unlock_undo() rather than function radeon_ring_unlock_commit() should be called. However, in function radeon_test_create_and_emit

[PATCH 1/1] drm/radeon: check return vlaue of radeon_fence_emit

From: Pan Bian Function radeon_fence_emit() returns -ENOMEM if there is no enough memory. And in this case, function radeon_ring_unlock_undo() rather than function radeon_ring_unlock_commit() should be called. However, in function radeon_test_create_and_emit_fence(), the return value

[PATCH 1/1] drm/radeon: check return value of radeon_ring_lock

From: Pan Bian <bianpan2...@163.com> Function radeon_ring_lock() returns an errno on failure, and its return value should be validated. However, in functions r420_cp_errata_init() and r420_cp_errata_fini(), its return value is not checked. This patch adds the checks. Signed-off-by: Pa

[PATCH 1/1] drm/radeon: check return value of radeon_ring_lock

From: Pan Bian Function radeon_ring_lock() returns an errno on failure, and its return value should be validated. However, in functions r420_cp_errata_init() and r420_cp_errata_fini(), its return value is not checked. This patch adds the checks. Signed-off-by: Pan Bian --- drivers/gpu/drm

[PATCH 1/1] cfg80211: add return value validation

From: Pan Bian <bianpan2...@163.com> Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its return value is not checked. This may cause NULL deref

[PATCH 1/1] cfg80211: add return value validation

From: Pan Bian Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its return value is not checked. This may cause NULL dereference bugs. This patch fixes

[PATCH 1/1] libertas: check return value of alloc_workqueue

From: Pan Bian <bianpan2...@163.com> Function alloc_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function if_spi_probe(), its return value is not checked. This may result in a NULL dereferen

[PATCH 1/1] libertas: check return value of alloc_workqueue

From: Pan Bian Function alloc_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function if_spi_probe(), its return value is not checked. This may result in a NULL dereference bug. This patch fixes the bug

[PATCH 1/1] [media] cx25840: fix unchecked return values

From: Pan Bian <bianpan2...@163.com> In functions cx25840_initialize(), cx231xx_initialize(), and cx23885_initialize(), the return value of create_singlethread_workqueue() is used without validation. This may result in NULL dereference and cause kernel crash. This patch fixes it. Sign

[PATCH 1/1] [media] cx25840: fix unchecked return values

From: Pan Bian In functions cx25840_initialize(), cx231xx_initialize(), and cx23885_initialize(), the return value of create_singlethread_workqueue() is used without validation. This may result in NULL dereference and cause kernel crash. This patch fixes it. Signed-off-by: Pan Bian

[PATCH 1/1] rtc: gemini: add return value validation

From: Pan Bian <bianpan2...@163.com> Function devm_ioremap() will return a NULL pointer if it fails to remap IO address, and its return value should be validated before it is used. However, in function gemini_rtc_probe(), its return value is not checked. This may result in bad memory acces

[PATCH 1/1] rtc: gemini: add return value validation

From: Pan Bian Function devm_ioremap() will return a NULL pointer if it fails to remap IO address, and its return value should be validated before it is used. However, in function gemini_rtc_probe(), its return value is not checked. This may result in bad memory access bugs on future access, e.g

[PATCH 1/1] mfd: intel_soc_pmic_core: fix unchecked return value

From: Pan Bian <bianpan2...@163.com> unction devm_regmap_init_i2c() returns an ERR_PTR on errors, and its return value should be checked before it is dereferenced. However, in function intel_soc_pmic_i2c_probe(), the return value of function devm_regmap_init_i2c() is used without vali

[PATCH 1/1] mfd: intel_soc_pmic_core: fix unchecked return value

From: Pan Bian unction devm_regmap_init_i2c() returns an ERR_PTR on errors, and its return value should be checked before it is dereferenced. However, in function intel_soc_pmic_i2c_probe(), the return value of function devm_regmap_init_i2c() is used without validation. This patch fixes

[PATCH 1/1] [media] cobalt: fix unchecked return values

From: Pan Bian <bianpan2...@163.com> Function pci_find_ext_capability() may return 0, which is an invalid address. In function cobalt_pcie_status_show(), its return value is used without validation. This patch adds checks to validate the return address. Signed-off-by: Pan Bian <bianpa

[PATCH 1/1] [media] cobalt: fix unchecked return values

From: Pan Bian Function pci_find_ext_capability() may return 0, which is an invalid address. In function cobalt_pcie_status_show(), its return value is used without validation. This patch adds checks to validate the return address. Signed-off-by: Pan Bian --- drivers/media/pci/cobalt/cobalt

[PATCH 1/1] qlcnic: fix unchecked return value

From: Pan Bian <bianpan2...@163.com> Function pci_find_ext_capability() may return 0, which is an invalid address. In function qlcnic_sriov_virtid_fn(), its return value is used without validation. This may result in invalid memory access bugs. This patch fixes the bug. Signed-off-by: Pa

[PATCH 1/1] qlcnic: fix unchecked return value

From: Pan Bian Function pci_find_ext_capability() may return 0, which is an invalid address. In function qlcnic_sriov_virtid_fn(), its return value is used without validation. This may result in invalid memory access bugs. This patch fixes the bug. Signed-off-by: Pan Bian --- drivers/net

[PATCH 1/1] staging: wilc1000: fix unchecked return value

From: Pan Bian <bianpan2...@163.com> Function dev_alloc_skb() will return a NULL pointer if there is no enough memory. However, in function WILC_WFI_mon_xmit(), its return value is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-b

[PATCH 1/1] staging: wilc1000: fix unchecked return value

From: Pan Bian Function dev_alloc_skb() will return a NULL pointer if there is no enough memory. However, in function WILC_WFI_mon_xmit(), its return value is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian --- drivers

[PATCH 1/1] usb: hub: check return value

From: Pan Bian <bianpan2...@163.com> Function usb_autopm_get_interface() will return a negative errno on failure, and function usb_autopm_put_interface() should not be called if it fails. However, in function usb_remove_device(), the return value of function usb_autopm_get_int

[PATCH 1/1] usb: hub: check return value

From: Pan Bian Function usb_autopm_get_interface() will return a negative errno on failure, and function usb_autopm_put_interface() should not be called if it fails. However, in function usb_remove_device(), the return value of function usb_autopm_get_interface() is not validated before calling

[PATCH 1/1] iommu/amd: fix incorrect error handling

From: Pan Bian <bianpan2...@163.com> In function amd_iommu_bind_pasid(), the control flow jumps to label out_free when pasid_state->mm and mm is NULL. And mmput(mm) is called. In function mmput(mm), mm is referenced without validation. This will result in a NULL dereference bug. This pa

[PATCH 1/1] iommu/amd: fix incorrect error handling

From: Pan Bian In function amd_iommu_bind_pasid(), the control flow jumps to label out_free when pasid_state->mm and mm is NULL. And mmput(mm) is called. In function mmput(mm), mm is referenced without validation. This will result in a NULL dereference bug. This patch fixes the bug. Signed-

[PATCH 1/1] char: xillybus: check return value

From: Pan Bian <bianpan2...@163.com> Function of_address_to_resource() tries to translate device tree address and return as resource. If the translation fails, it will return a negative errno. However, function xilly_drv_probe() does not validate its return value, which may result in a bad

[PATCH 1/1] char: xillybus: check return value

From: Pan Bian Function of_address_to_resource() tries to translate device tree address and return as resource. If the translation fails, it will return a negative errno. However, function xilly_drv_probe() does not validate its return value, which may result in a bad memory access bug

[PATCH 1/1] net: bcmgenet: fix incorrect return value checks

From: Pan Bian <bianpan2...@163.com> Function platform_get_irq() will return a negative value on errors. However, in function bcmgenet_probe(), 0 is considered as a flag of error. This patch fixes the bug by checking whether the return value of platform_get_irq() is less than 0. Sign

[PATCH 1/1] net: bcmgenet: fix incorrect return value checks

From: Pan Bian Function platform_get_irq() will return a negative value on errors. However, in function bcmgenet_probe(), 0 is considered as a flag of error. This patch fixes the bug by checking whether the return value of platform_get_irq() is less than 0. Signed-off-by: Pan Bian --- drivers

[PATCH 1/1] staging: comedi: addi_apci_3xxx: check return value

From: Pan Bian <bianpan2...@163.com> Function pci_ioremap_bar() will return a NULL pointer if there is no enough memory. However, in function apci3xxx_auto_attach(), the return value of function pci_ioremap_bar() is not validated. This may result in NULL dereference in following access

[PATCH 1/1] staging: comedi: addi_apci_3xxx: check return value

From: Pan Bian Function pci_ioremap_bar() will return a NULL pointer if there is no enough memory. However, in function apci3xxx_auto_attach(), the return value of function pci_ioremap_bar() is not validated. This may result in NULL dereference in following access to dev->mmio. This patch fi

[PATCH 1/1] wan: pc300too: abort path on failure

From: Pan Bian <bianpan2...@163.com> In function pc300_pci_init_one(), on the ioremap error path, function pc300_pci_remove_one() is called to free the allocated memory. However, the path is not terminated, and the freed memory will be used later, resulting in use-after-free bugs. This path

[PATCH 1/1] wan: pc300too: abort path on failure

From: Pan Bian In function pc300_pci_init_one(), on the ioremap error path, function pc300_pci_remove_one() is called to free the allocated memory. However, the path is not terminated, and the freed memory will be used later, resulting in use-after-free bugs. This path fixes the bug. Signed-off

[PATCH 1/1] m5602_s5k83a: check return value of kthread_create

From: Pan Bian <bianpan2...@163.com> Function kthread_create() returns an ERR_PTR on error. However, in function s5k83a_start(), its return value is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian <bianpan2..

[PATCH 1/1] m5602_s5k83a: check return value of kthread_create

From: Pan Bian Function kthread_create() returns an ERR_PTR on error. However, in function s5k83a_start(), its return value is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian --- drivers/media/usb/gspca/m5602

[PATCH 1/1] iw_cxgb4: check return value of alloc_skb

Function alloc_skb() will return a NULL pointer when there is no enough memory. However, the return value of alloc_skb() is directly used without validation in function send_fw_pass_open_req(). This patches checks the return value of alloc_skb() against NULL. Signed-off-by: Pan Bian <bianp

[PATCH 1/1] iw_cxgb4: check return value of alloc_skb

Function alloc_skb() will return a NULL pointer when there is no enough memory. However, the return value of alloc_skb() is directly used without validation in function send_fw_pass_open_req(). This patches checks the return value of alloc_skb() against NULL. Signed-off-by: Pan Bian --- drivers

[PATCH 1/1] power: check return value of devm_kzalloc

Function devm_kzalloc() will return a NULL pointer if there is no enough memory. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian <bianp

[PATCH 1/1] power: check return value of devm_kzalloc

Function devm_kzalloc() will return a NULL pointer if there is no enough memory. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian --- drivers

[PATCH 2/2] team: fix memory leak

In function team_nl_send_options_get(), pointer skb keeps the return value of function nlmsg_new(). When the call to genlmsg_put() fails, the control flow directly returns and does not free skb. This will result in a memory leak bug. This patch fixes it. Signed-off-by: Pan Bian <bianpan2...@

[PATCH 2/2] team: fix memory leak

In function team_nl_send_options_get(), pointer skb keeps the return value of function nlmsg_new(). When the call to genlmsg_put() fails, the control flow directly returns and does not free skb. This will result in a memory leak bug. This patch fixes it. Signed-off-by: Pan Bian --- drivers/net

[PATCH 1/2] team: fix memory leak

In function team_nl_send_port_list_get(), pointer skb keeps the return value of nlmsg_new(). When the call to genlmsg_put() fails, the memory is not freed. This will result in a memory leak bug. This patch fixes it. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/net/team/team

[PATCH 1/2] team: fix memory leak

In function team_nl_send_port_list_get(), pointer skb keeps the return value of nlmsg_new(). When the call to genlmsg_put() fails, the memory is not freed. This will result in a memory leak bug. This patch fixes it. Signed-off-by: Pan Bian --- drivers/net/team/team.c | 4 +++- 1 file changed, 3

[PATCH 1/1] tipc: check return value of nlmsg_new

-by: Pan Bian <bianpan2...@163.com> --- net/tipc/node.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/tipc/node.c b/net/tipc/node.c index 4512e83..568e48d 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -2098,6 +2098,8 @@ int tipc_nl_node_get_monitor(struct sk_buff *skb,

[PATCH 1/1] tipc: check return value of nlmsg_new

-by: Pan Bian --- net/tipc/node.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/tipc/node.c b/net/tipc/node.c index 4512e83..568e48d 100644 --- a/net/tipc/node.c +++ b/net/tipc/node.c @@ -2098,6 +2098,8 @@ int tipc_nl_node_get_monitor(struct sk_buff *skb, struct genl_info *info) int

[PATCH 1/1] mt7601u: check return value of alloc_skb

Function alloc_skb() will return a NULL pointer if there is no enough memory. However, in function mt7601u_mcu_msg_alloc(), its return value is not validated before it is used. This patch fixes it. Signed-off-by: Pan Bian <bianpan2...@163.com> --- drivers/net/wireless/mediatek/mt7601u/mcu.

[PATCH 1/1] mt7601u: check return value of alloc_skb

Function alloc_skb() will return a NULL pointer if there is no enough memory. However, in function mt7601u_mcu_msg_alloc(), its return value is not validated before it is used. This patch fixes it. Signed-off-by: Pan Bian --- drivers/net/wireless/mediatek/mt7601u/mcu.c | 10 -- 1 file

[PATCH 1/1] NFSv4: check return value of xdr_inline_decode

of xdr_inline_decode(). Signed-off-by: Pan Bian <bianpan2...@163.com> --- fs/nfs/nfs4xdr.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index 80ce289..81afbbd 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -5579,6 +5579,8 @@ static int decode_

[PATCH 1/1] NFSv4: check return value of xdr_inline_decode

of xdr_inline_decode(). Signed-off-by: Pan Bian --- fs/nfs/nfs4xdr.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c index 80ce289..81afbbd 100644 --- a/fs/nfs/nfs4xdr.c +++ b/fs/nfs/nfs4xdr.c @@ -5579,6 +5579,8 @@ static int decode_op_map(struct xdr_stream

[PATCH 1/1] openvswitch: check return value of nla_nest_start

-off-by: Pan Bian <bianpan2...@163.com> --- net/openvswitch/datapath.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 9c62b63..34c0fbd 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/data

<    1   2   3   4   >