[PATCH] net: dsa: lan9303: correctly check return value of devm_gpiod_get_optional

Function devm_gpiod_get_optional() returns an ERR_PTR on failure. Its return value should not be validated by a NULL check. Instead, use IS_ERR. Signed-off-by: Pan Bian --- drivers/net/dsa/lan9303-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/dsa/lan9303

[PATCH] power: supply: cpcap-charger: fix incorrect return value check

ate the return value of platform_get_irq_byname(). Signed-off-by: Pan Bian --- drivers/power/supply/cpcap-charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/power/supply/cpcap-charger.c b/drivers/power/supply/cpcap-charger.c index 11a0763..e4905be 100644 --- a/dri

[PATCH] iio: adc: cpcap: fix incorrect validation

validate the return value of platform_get_irq_byname(). Signed-off-by: Pan Bian --- drivers/iio/adc/cpcap-adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/cpcap-adc.c b/drivers/iio/adc/cpcap-adc.c index 6e419d5..f153e026 100644 --- a/drivers/iio/adc/cpca

[PATCH] scsi: advansys: fix improper function call to kfree

In function advansys_eisa_probe(), data->host[i] holds the return value of scsi_host_alloc(). The memory allocated by scsi_host_alloc() should be deallocated with scsi_host_put(), not kfree(). Signed-off-by: Pan Bian --- drivers/scsi/advansys.c | 4 ++-- 1 file changed, 2 insertions(+)

gma500: mmu: unmap the correct address

The function kunmap_atomatic() is called on the same variable twice, i.e. pt->v. In the second call, its parameter should be variable v rather than pt->v. Signed-off-by: Pan Bian --- drivers/gpu/drm/gma500/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/g

ubi: fastmap: use kmem_cache_free to deallocate memory

Memory allocated by kmem_cache_alloc() should not be deallocated with kfree(). Use kmem_cache_free() instead. Signed-off-by: Pan Bian --- drivers/mtd/ubi/fastmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c index

net: lapbether: fix double free

The function netdev_priv() returns the private data of the device. The memory to store the private data is allocated in alloc_netdev() and is released in netdev_free(). Calling kfree() on the return value of netdev_priv() after netdev_free() results in a double free bug. Signed-off-by: Pan Bian

net: hns: set correct return value

unexpected. Signed-off-by: Pan Bian --- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c index 3652063..e771926 100644 --- a/drivers

efi/esrt: use memunmap rather kfree to free the remapping

The remapping result of memremap should be freed with memunmap, not kfree. Signed-off-by: Pan Bian --- drivers/firmware/efi/esrt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c index bd7ed3c..3ef7001 100644 --- a

scsi: advansys: fix improper function call to kfree

In function advansys_eisa_probe(), data->host[i] holds the return value of scsi_host_alloc(). The memory allocated by scsi_host_alloc() should be deallocated with scsi_host_put(), not kfree(). Signed-off-by: Pan Bian --- drivers/scsi/advansys.c | 4 ++-- 1 file changed, 2 insertions(+)

[PATCH] net: hns: set correct return value

unexpected. Signed-off-by: Pan Bian --- drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c index 3652063..e771926 100644 --- a/drivers

[PATCH] exportfs: do not read dentry after free

try with its parent obtained before dropping the reference. Fixes: a056cc8934c("exportfs: stop retrying once we race with rename/remove") Signed-off-by: Pan Bian --- fs/exportfs/expfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/exportfs/expfs.c b/fs/exportfs/

[PATCH V2] exportfs: do not read dentry after free

try with its parent obtained before dropping the reference. Fixes: a056cc8934c("exportfs: stop retrying once we race with rename/remove") Signed-off-by: Pan Bian --- V2: get rid of the comment --- fs/exportfs/expfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

[PATCH] hfs: do not free node before using

s to pr_") Signed-off-by: Pan Bian --- fs/hfs/btree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c index 98b96ff..19017d2 100644 --- a/fs/hfs/btree.c +++ b/fs/hfs/btree.c @@ -338,13 +338,14 @@ void hfs_bmap_free(struct hf

[PATCH V2] hfs: do not free node before using

The function hfs_bmap_free frees node via hfs_bnode_put(node). However, it then reads node->this when dumping error message on an error path, which may result in a use-after-free bug. This patch frees node only when it is never used. Fixes: a1185ffa2fc("HFS rewrite") Signed-off

[PATCH] namei: free new_dentry late

After calling dput(new_dentry), new_dentry is passed to fsnotify_move. This may result in a use-after-free bug. This patch moves the put operation late. Fixes: 49d31c2f389a("dentry name snapshots") Signed-off-by: Pan Bian --- fs/namei.c | 2 +- 1 file changed, 1 insertion(+),

[PATCH] xfs: libxfs: move xfs_perag_put late

The function xfs_alloc_get_freelist calls xfs_perag_put to drop the reference. In this case, pag may be released. However, pag->pagf_btreeblks is read and write after the put operation. This may result in a use-after-free bug. This patch moves the put operation late. Signed-off-by: Pan B

[PATCH 1/1] hfsplus: do not free node before using

The function hfs_bmap_free frees node via hfs_bnode_put(node). However, it then reads node->this when dumping error message on an error path, which may result in a use-after-free bug. This patch frees node only when it is never used. Signed-off-by: Pan Bian --- fs/hfsplus/btree.c | 3 ++-

[PATCH V2] namei: free new_dentry late

After calling dput(new_dentry), new_dentry is passed to fsnotify_move. This may result in a use-after-free bug. This patch moves the put operation late. Fixes: da1ce0670c14("vfs: add cross-rename") Signed-off-by: Pan Bian --- V2: correct the fixes commit information --- fs/namei.c

[PATCH] ext2: fix potential use after free

The function ext2_xattr_set calls brelse(bh) to drop the reference count of bh. After that, bh may be freed. However, following brelse(bh), it reads bh->b_data via macro HDR(bh). This may result in a use-after-free bug. This patch moves brelse(bh) after reading field. Signed-off-by: Pan B

[PATCH] freevxfs: set bp to NULL after dropping its reference in loop

-off-by: Pan Bian --- fs/freevxfs/vxfs_bmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/freevxfs/vxfs_bmap.c b/fs/freevxfs/vxfs_bmap.c index 1fd41cf..136e5d1 100644 --- a/fs/freevxfs/vxfs_bmap.c +++ b/fs/freevxfs/vxfs_bmap.c @@ -150,6 +150,7 @@ vxfs_bmap_indir(struct inode *ip, long

[PATCH] autofs: drop dentry reference only when it is never used

The function autofs_expire_run calls dput(dentry) to drop the reference count of dentry. However, dentry is read via autofs_dentry_ino(dentry) after that. This may result in a use-free-bug. The patch drops the reference count of dentry only when it is never used. Signed-off-by: Pan Bian --- fs

[PATCH] fs/qnx6: set and bh1 and bh2 to NULL after dropping references

. The patch sets bh1 and bh2 to NULL after their reference counts are decreased. Signed-off-by: Pan Bian --- fs/qnx6/inode.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/qnx6/inode.c b/fs/qnx6/inode.c index 4aeb26b..e8a8536 100644 --- a/fs/qnx6/inode.c +++ b/fs/qnx6/inode.c @@ -405,12

[PATCH] nilfs2: fix potential use after free

ing and putting the page. Signed-off-by: Pan Bian --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aa3c328..a24bb29 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@

[PATCH] ext4: fix possible use after free in ext4_quota_enable

The function frees qf_inode via iput but then pass qf_inode to lockdep_set_quota_inode on the failure path. This may result in a use-after-free bug. The patch frees df_inode only when it is never used. Signed-off-by: Pan Bian Fixes: daf647d2dd5("ext4: add lockdep annotations for i_dat

[PATCH V2] xfs: libxfs: move xfs_perag_put late

The function xfs_alloc_get_freelist calls xfs_perag_put to drop the reference. However, pag->pagf_btreeblks is read and write after the put operation. This patch moves the put operation late. Signed-off-by: Pan Bian --- V2: correct the commit log --- fs/xfs/libxfs/xfs_alloc.c | 2 +- 1 f

[PATCH] HID: intel-ish-hid: fixes incorrect error handling

The memory chunk allocated by hid_allocate_device() should be released by hid_destroy_device(), not kfree(). Fixes: 0b28cb4bcb1("HID: intel-ish-hid: ISH HID client driver") Signed-off-by: Pan Bian --- drivers/hid/intel-ish-hid/ishtp-hid.c | 2 +- 1 file changed, 1 insertion(+),

[PATCH] drivers/memstick/host/jmb38x_ms: fixes incorrect error handling

kfree() is incorrectly used to free the memory chunk allocated by memstick_alloc_host(). Instead, memstick_free_host() should be used. Fixes: 60fdd931d577("memstick: add support for JMicron jmb38x ...") Signed-off-by: Pan Bian --- drivers/memstick/host/jmb38x_ms.c | 2 +- 1 file

[PATCH] sis5513: fix potential use after free

The function sis_find_family drops lpc_bridge reference via pci_dev_put, however, after that, field lpc_bridge->revision is read. This may result in a use after free bug. The patch moves the put operation after the condition check. Signed-off-by: Pan Bian --- drivers/ide/sis5513.c | 3 ++-

[PATCH] ata: read ->revision before dropping pci_device reference

pci_device->revision is read after dropping pci_device reference via pci_dev_put, which may result in use-after-free bugs. To fix this, the patch reads ->revision before dropping reference. Signed-off-by: Pan Bian --- drivers/ata/pata_sis.c | 4 +++- drivers/ata/pata_sl82c105.c | 4 +

[PATCH] ubi: put MTD device after it is not used

The MTD device reference is dropped via put_mtd_device, however its field ->index is read and passed to ubi_msg. To fix this, the patch moves the reference dropping after calling ubi_msg. Signed-off-by: Pan Bian --- drivers/mtd/ubi/build.c | 2 +- 1 file changed, 1 insertion(+), 1 delet

[PATCH] ubi: do not drop UBI device reference before using

/messaging capabilities") Signed-off-by: Pan Bian --- drivers/mtd/ubi/kapi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c index e9e9ecb..0b8f0c4 100644 --- a/drivers/mtd/ubi/kapi.c +++ b/drivers/mtd/ubi/kapi.c @@ -227,9 +

mmc: core: fix possible use after free of host

owever, after put_device, host is used and released again. Resulting in a use-after-free bug. Fixes: 1ed21719448("mmc: core: fix error path in mmc_host_alloc") Signed-off-by: Pan Bian --- drivers/mmc/core/host.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/mmc/core/host.c b/

mcb: correct error handling in mcb_alloc_bus

There are two issues in the error handling code. First, if ID allocation fails, the reference count of carrier is decremented, which has not been incremented yet. Second, if device_add fails, the allocated ID will not be released. This patches fixes them. Signed-off-by: Pan Bian --- drivers/mcb

fsi: use put_device to release resource on error path

ned-off-by: Pan Bian --- drivers/fsi/fsi-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c index 2c31563..2bb6625 100644 --- a/drivers/fsi/fsi-core.c +++ b/drivers/fsi/fsi-core.c @@ -1056,8 +1056,7 @@ static int fsi_slave_i

Input: synaptics-rmi4: fix possible double free

The RMI4 function structure has been released in rmi_register_function if error occurs. However, it will be released again in the function rmi_create_function, which may result in a double-free bug. Signed-off-by: Pan Bian --- drivers/input/rmi4/rmi_driver.c | 6 +- 1 file changed, 1

EDAC: Fix memory leak in creating CSROW object

In the function that creates a CSROW object, the object is not released when failing to add the device to device hierarchy. This may result in a memory leak bug. Signed-off-by: Pan Bian --- drivers/edac/edac_mc_sysfs.c | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a

iio: dummy_evgen: fix possible memleak in evgen init

The memory allocated in the function iio_dummy_evgen_create is not released if it fails to add the evgen device to device hierarchy. This may result in a memory leak bug. Signed-off-by: Pan Bian --- drivers/iio/dummy/iio_dummy_evgen.c | 5 - 1 file changed, 4 insertions(+), 1 deletion

stm class: Fix possible double free

_device. This patch fixes these issues. Signed-off-by: Pan Bian --- drivers/hwtracing/stm/core.c | 9 - 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c index c7ba8ac..cfb5c4d 100644 --- a/drivers/hwtracing/stm/core.

ext4: avoid drop reference to iloc.bh twice

The reference to iloc.bh has been dropped in ext4_mark_iloc_dirty. However, the reference is dropped again if error occurs during ext4_handle_dirty_metadata, which may result in use-after-free bugs. Fixes: fb265c9cb49e("ext4: add ext4_sb_bread() to disambiguate ENOMEM cases") Signed-o

[PATCH] isofs: release buffer head before return

Release the buffer header before returning error code. Fixes: 2deb1acc653c ("isofs: fix access to unallocated memory when reading corrupted filesystem") Signed-off-by: Pan Bian --- fs/isofs/dir.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/isofs/dir.c b/fs/isofs/d

[PATCH] ext4: stop update inode before return

Stop inode updating before returning the error code. Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Signed-off-by: Pan Bian --- fs/ext4/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index c173c8405856..64

[PATCH 1/1] bsg: free the request before return error code

Free the request rq before returning error code. Fixes: 972248e9111e ("scsi: bsg-lib: handle bidi requests without block layer help") Signed-off-by: Pan Bian --- block/bsg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/block/bsg.c b/block/bsg.c index d7

[PATCH] net: systemport: free dev before on error path

On the error path, it should goto the error handling label to free allocated memory rather than directly return. Fixes: 6328a126896e ("net: systemport: Manage Wake-on-LAN clock") Signed-off-by: Pan Bian --- drivers/net/ethernet/broadcom/bcmsysport.c | 6 -- 1 file changed, 4

[PATCH] fs/affs: release old buffer head on error path

The reference count of the old buffer head should be decremented on path that fails to get the new buffer head. Fixes: 6b4657667ba0 ("fs/affs: add rename exchange") Signed-off-by: Pan Bian --- fs/affs/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/af

[PATCH] drm/imx: fix memory leak when fails to init

Put DRM device on initialization failure path rather than directly return error code. Fixes: a67d5088ceb8 ("drm/imx: drop explicit drm_mode_config_cleanup") Signed-off-by: Pan Bian --- drivers/gpu/drm/imx/imx-drm-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

[PATCH] regulator: axp20x: Fix reference cout leak

Decrements the reference count of device node and its child node. Fixes: dfe7a1b058bb ("regulator: AXP20x: Add support for regulators subsystem") Signed-off-by: Pan Bian --- drivers/regulator/axp20x-regulator.c | 7 +++ 1 file changed, 3 insertions(+), 4 deletions(-) diff --git

[PATCH] PCI: xilinx-cpm: Fix reference count leak on error path

Also drop the reference count of the node on error path. Fixes: 508f610648b9 ("PCI: xilinx-cpm: Add Versal CPM Root Port driver") Signed-off-by: Pan Bian --- drivers/pci/controller/pcie-xilinx-cpm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pci/controller/pcie-xilin

[PATCH] thermal: drop reference of child node on error

Drop the reference of the child node sen_child before goto out of the loop. Signed-off-by: Pan Bian --- drivers/thermal/sprd_thermal.c | 4 1 file changed, 4 insertions(+) diff --git a/drivers/thermal/sprd_thermal.c b/drivers/thermal/sprd_thermal.c index 3682edb2f466..e843f10167b8 100644

[PATCH] net: stmmac: dwmac-intel-plat: remove config data on error

Remove the config data when rate setting fails. Fixes: 9efc9b2b04c7 ("net: stmmac: Add dwmac-intel-plat for GBE driver") Signed-off-by: Pan Bian --- drivers/net/ethernet/stmicro/stmmac/dwmac-intel-plat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/d

[PATCH] net: fec: put child node on error path

Also decrement the reference count of child device on error path. Fixes: 3e782985cb3c ("net: ethernet: fec: Allow configuration of MDIO bus speed") Signed-off-by: Pan Bian --- drivers/net/ethernet/freescale/fec_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) di

[PATCH] cifs: put tlink before return

Put tlink before returning error code. Fixes: 8ceb98437946 ("CIFS: Move rename to ops struct") Signed-off-by: Pan Bian --- fs/cifs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index a83b3a8ffaac..9c31b6178638 10064

[PATCH] bpf: put file handler if no storage found

Put file f if inode_storage_ptr() returns NULL. Fixes: 8ea636848aca ("bpf: Implement bpf_local_storage for inodes") Acked-by: KP Singh Signed-off-by: Pan Bian --- kernel/bpf/bpf_inode_storage.c | 6 +- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/

[PATCH] regulator: s5m8767: Fix reference count leak

Call of_node_put() to drop references of regulators_np and reg_np before returning error code. Fixes: 9ae5cc75ceaa ("regulator: s5m8767: Pass descriptor instead of GPIO number") Signed-off-by: Pan Bian --- drivers/regulator/s5m8767.c | 7 +-- 1 file changed, 5 insertions(+), 2

[PATCH] Bluetooth: Put HCI device if inquiry procedure interrupts

Jump to the label done to decrement the reference count of HCI device hdev on path that the Inquiry procedure is interrupted. Fixes: 3e13fa1e1fab ("Bluetooth: Fix hci_inquiry ioctl usage") Signed-off-by: Pan Bian --- net/bluetooth/hci_core.c | 6 -- 1 file changed, 4 insert

[PATCH] net/mlx5e: free page before return

Instead of directly return, goto the error handling label to free allocated page. Fixes: 5f29458b77d5 ("net/mlx5e: Support dump callback in TX reporter") Signed-off-by: Pan Bian --- drivers/net/ethernet/mellanox/mlx5/core/en/health.c | 2 +- 1 file changed, 1 insertion(+), 1 deletio

[PATCH] mtd: spi-nor: hisi-sfc: Put child node np on error path

Put the child node np when it fails to get or register device. Signed-off-by: Pan Bian --- drivers/mtd/spi-nor/controllers/hisi-sfc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mtd/spi-nor/controllers/hisi-sfc.c b/drivers/mtd/spi-nor/controllers/hisi-sfc.c

[PATCH] memory: ti-aemif: Drop child node when jumping out loop

be dropped manually. Fixes: 5a7c81547c1d ("memory: ti-aemif: introduce AEMIF driver") Signed-off-by: Pan Bian --- drivers/memory/ti-aemif.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/memory/ti-aemif.c b/drivers/memory/ti-aemif.c index 15

[PATCH] net: dsa: bcm_sf2: put device node before return

Put the device node dn before return error code on failure path. Fixes: 461cd1b03e32 ("net: dsa: bcm_sf2: Register our slave MDIO bus") Signed-off-by: Pan Bian --- drivers/net/dsa/bcm_sf2.c | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/dsa/b

[PATCH] lightnvm: fix memory leak when submit fails

The allocated page is not released if error occurs in nvm_submit_io_sync_raw(). __free_page() is moved ealier to avoid possible memory leak issue. Fixes: aff3fb18f957 ("lightnvm: move bad block and chunk state logic to core") Signed-off-by: Pan Bian --- drivers/lightnvm/core.c | 3 +

[PATCH] Bluetooth: drop HCI device reference before return

Call hci_dev_put() to decrement reference count of HCI device hdev if fails to duplicate memory. Fixes: 0b26ab9dce74 ("Bluetooth: AMP: Handle Accept phylink command status evt") Signed-off-by: Pan Bian --- net/bluetooth/a2mp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net

[PATCH] bus: qcom: Put child node before return

t;bus: qcom: add EBI2 driver") Signed-off-by: Pan Bian --- drivers/bus/qcom-ebi2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c index 03ddcf426887..0b8f53a688b8 100644 --- a/drivers/bus/qcom-ebi2.c +++ b/drivers/bus/q

[PATCH] reset: berlin: Put parent device node on error path

Put parent device node parent_np if there is no enough memory. Fixes: aed6f3cadc86 ("reset: berlin: convert to a platform driver") Signed-off-by: Pan Bian --- drivers/reset/reset-berlin.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/reset/reset-

[PATCH] NFC: fix possible resource leak

Put the device to avoid resource leak on path that the polling flag is invalid. Fixes: a831b9132065 ("NFC: Do not return EBUSY when stopping a poll that's already stopped") Signed-off-by: Pan Bian --- net/nfc/netlink.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/nfc/

[PATCH] NFC: fix resource leak when target index is invalid

Goto to the label put_dev instead of the label error to fix potential resource leak on path that the target index is invalid. Fixes: c4fbb6515a4d ("NFC: The core part should generate the target index") Signed-off-by: Pan Bian --- net/nfc/rawsock.c | 2 +- 1 file changed, 1 inser

[PATCH] chtls: Fix potential resource leak

The dst entry should be released if no neighbour is found. Goto label free_dst to fix the issue. Besides, the check of ndev against NULL is redundant. Signed-off-by: Pan Bian --- .../net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c| 7 +++ 1 file changed, 3 insertions(+), 4 deletions

[PATCH] drm/i915/selftest: Fix potential memory leak

Object out is not released on path that no VMA instance found. The root cause is jumping to an unexpected label on the error path. Fixes: a47e788c2310 ("drm/i915/selftests: Exercise CS TLB invalidation") Signed-off-by: Pan Bian --- drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 2

[PATCH 1/1] orinoco: fix improper return value

bug.cgi?id=188671 Signed-off-by: Pan Bian --- drivers/net/wireless/intersil/orinoco/wext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intersil/orinoco/wext.c b/drivers/net/wireless/intersil/orinoco/wext.c index 1d4dae4..fee57ea 100644 --- a/drivers/ne

[PATCH 1/2] dmaengine: ioat: set error code on failures

. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188591 Signed-off-by: Pan Bian --- drivers/dma/ioat/init.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c index 015f711..32383ef 100644 --- a/drivers/dma/ioat/init.c +++ b/drivers/dma/ioat

[PATCH 2/2] dmaengine: ioat: set error code on failures

error path. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188601 Signed-off-by: Pan Bian --- drivers/dma/ioat/init.c | 16 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c index 32383ef..3d589f4 100644 --- a/d

[PATCH 1/1] extcon: return error code on failure

-ENOMEM. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188611 Signed-off-by: Pan Bian --- drivers/extcon/extcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c index 7829846..7c1e3a7 100644 --- a/drivers/extcon

[PATCH 1/1] dri: vc4: set error code on failure

kernel.org/show_bug.cgi?id=188631 Signed-off-by: Pan Bian --- drivers/gpu/drm/vc4/vc4_gem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c index 47a095f..2592a94 100644 --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4

[PATCH 1/1] iio: light: fix improper return value

patch fixes the bug. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188641 Signed-off-by: Pan Bian --- drivers/iio/light/cm3232.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/light/cm3232.c b/drivers/iio/light/cm3232.c index fe89b68..263e972 100644 --- a

[PATCH 1/1] misc: set error code when devm_kstrdup fails

lla: https://bugzilla.kernel.org/show_bug.cgi?id=188651 Signed-off-by: Pan Bian --- drivers/misc/sram.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c index f84b53d..0ef7d65 100644 --- a/drivers/misc/sram.c +++ b/drivers/misc/sram.c

[PATCH 1/1] netdev: broadcom: propagate error code

Function bnxt_hwrm_stat_ctx_alloc() always returns 0, even if the call to _hwrm_send_message() fails. It may be better to propagate the errors to the caller of bnxt_hwrm_stat_ctx_alloc(). Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188661 Signed-off-by: Pan Bian --- drivers/net

[PATCH 1/1] net: wireless: intersil: fix improper return value

bug.cgi?id=188671 Signed-off-by: Pan Bian --- drivers/net/wireless/intersil/orinoco/wext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intersil/orinoco/wext.c b/drivers/net/wireless/intersil/orinoco/wext.c index 1d4dae4..fee57ea 100644 --- a/drivers/ne

[PATCH 1/1] net: wireless: intersil: fix improper return value

bug.cgi?id=188671 Signed-off-by: Pan Bian --- drivers/net/wireless/intersil/orinoco/wext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intersil/orinoco/wext.c b/drivers/net/wireless/intersil/orinoco/wext.c index 1d4dae4..fee57ea 100644 --- a/drivers/ne

[PATCH 1/1] scsi: csiostor: fix improper return value

gi?id=188681 Signed-off-by: Pan Bian --- drivers/scsi/csiostor/csio_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c index 622bdab..8970df2 100644 --- a/drivers/scsi/csiostor/csio_hw.c +++ b/drivers/scs

[PATCH 1/1] tty: serial: set error code when kasprintf fails

assigns "-ENOMEM" to the return variable ret. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188691 Signed-off-by: Pan Bian --- drivers/tty/serial/sh-sci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/seria

[PATCH 1/1] net: wireless: marvell: fix improper return value

stack memory to user sapce, resulting in stack information leak. To avoid the bug, this patch returns variable ret (which takes the return value of lbs_cmd_with_response()) instead of 0. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451 Signed-off-by: Pan Bian --- drivers/net/wireless

[PATCH 1/1] xen: xenbus: set error code on failure

kernel.org/show_bug.cgi?id=188721 Signed-off-by: Pan Bian --- drivers/xen/xenbus/xenbus_probe.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c index 33a31cf..f87d047 100644 --- a/drivers/xen/xenbus/xenbus_pro

[PATCH 1/1] btrfs: fix improper return value

In function btrfs_uuid_tree_iterate(), errno is assigned to variable ret on errors. However, it directly returns 0. It may be better to return ret. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188731 Signed-off-by: Pan Bian --- fs/btrfs/uuid-tree.c | 2 +- 1 file changed, 1 insertion

[PATCH 1/1] net: usb: set error code when usb_alloc_urb fails

o ret when usb_alloc_urb() returns a NULL pointer. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188771 Signed-off-by: Pan Bian --- drivers/net/usb/lan78xx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index db558b8..f33460c 10

[PATCH 1/1] net: bridge: set error code on failure

Function br_sysfs_addbr() does not set error code when the call kobject_create_and_add() returns a NULL pointer. It may be better to return "-ENOMEM" when kobject_create_and_add() fails. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188781 Signed-off-by: Pan Bian ---

[PATCH 1/1] net: caif: fix ineffective error check

In function caif_sktinit_module(), the check of the return value of sock_register() seems ineffective. This patch fixes it. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188751 Signed-off-by: Pan Bian --- net/caif/caif_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion

[PATCH 1/1] btrfs: volumes: fix improper return value

Variable ret takes the errno on failures. However, it directly returns 0. It may be better to return "ret". Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188741 Signed-off-by: Pan Bian --- fs/btrfs/volumes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git

[PATCH 1/1] media: platform: sti: return -ENOMEM on errors

From: Pan Bian Function bdisp_debugfs_create() returns 0 even on errors. So its caller cannot detect the errors. It may be better to return "-ENOMEM" on the exception paths. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188801 Signed-off-by: Pan Bian --- drivers/media/pl

[PATCH 1/1] atm: lanai: set error code when ioremap fails

?id=188791 Signed-off-by: Pan Bian --- drivers/atm/lanai.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c index ce43ae3..445505d 100644 --- a/drivers/atm/lanai.c +++ b/drivers/atm/lanai.c @@ -2143,6 +2143,7 @@ static int lanai_dev_open(struct atm_d

[PATCH 1/1] staging: lustre: lnet: fix improper return value

From: Pan Bian At the end of function lstcon_group_info(), "return 0" seems improper. It may be better to return the value of rc. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188811 Signed-off-by: Pan Bian --- drivers/staging/lustre/lnet/selftest/console.c | 2 +- 1 file

[PATCH 1/1] infiniband: hw: cxgb4: set errno on failure

From: Pan Bian In function c4iw_rdev_open(), the value of return variable err should be negative on errors. However, when the call to __get_free_page() returns a NULL pointer, its value is not set to "-ENOMEM" and keeps 0. 0 means no error. And thus, the behavior of its caller may

[PATCH 1/1] net: ethernet: 3com: set error code on failures

From: Pan Bian In function typhoon_init_one(), returns the value of variable err on errors. However, on some error paths, variable err is not set to a negative errno. This patch assigns "-EIO" to err on those paths. Signed-off-by: Pan Bian --- drivers/net/ethernet/3com/typhoon.c

[PATCH 1/1] scsi: csiostor: fix improper reference to variable

From: Pan Bian In function csio_config_device_caps(), returns the value of variable rv on error paths. However, when validating device capabilities, its value is reset, and will be 0 on the following error paths. 0 means no error in this context. It may be better to use variable retval to

[PATCH 1/1] scsi: 32-9xxx: fix improper return value on errors

From: Pan Bian In function twa_probe(), returns the value of variable retval on error paths. However, on some error paths, retval is not set to negative errnos, and its value will keep 0. This patch fixes them. Signed-off-by: Pan Bian --- drivers/scsi/3w-9xxx.c | 6 +- 1 file changed, 5

[PATCH 1/1] net: dcb: set error code on failures

From: Pan Bian In function dcbnl_cee_fill(), returns the value of variable err on errors. However, on some error paths (e.g. nla put fails), its value may be 0. It may be better to explicitly set a negative errno to variable err before returning. Bugzilla: https://bugzilla.kernel.org

[PATCH 1/1] infiniband: hw: ocrdma: fix bad initialization

From: Pan Bian In function ocrdma_mbx_create_ah_tbl(), returns the value of status on errors. However, because status is initialized with 0, 0 will be returned even if on error paths. This patch initialize status with "-ENOMEM". Bugzilla: https://bugzilla.kernel.org/show_bug.cgi

[PATCH 1/1] staging: iio: cdc: fix improper return value

From: Pan Bian At the end of function ad7150_write_event_config(), directly returns 0. As a result, the errors will be ignored by the callers. It may be better to return variable "ret". Signed-off-by: Pan Bian --- drivers/staging/iio/cdc/ad7150.c | 2 +- 1 file changed, 1 inser

[PATCH 1/1] crypto: asymmetric_keys: set error code on failure

From: Pan Bian In function public_key_verify_signature(), returns variable ret on error paths. When the call to kmalloc() fails, the value of ret is 0, and it is not set to an errno before returning. This patch fixes the bug. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188891 Signed

[PATCH 1/1] cpuidle: fix improper return value on error

From: Pan Bian In function cpuidle_add_state_sysfs(), variable ret takes the return value. Its value should be negative on errors. Because ret is reset in the loop, its value will be 0 during the second and after repeat of the loop. If kzalloc() returns a NULL pointer then, it will return 0. It

[PATCH 1/1] gpu: drm: qxl: fix use of uninitialized variable

"-ENOMEM" when kmalloc() fails. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188911 Signed-off-by: Pan Bian --- drivers/gpu/drm/qxl/qxl_release.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl

Re: [PATCH 1/1] net: ethernet: 3com: set error code on failures

(). Thanks! Best regards, Pan On Sat, Dec 03, 2016 at 02:53:07PM +0100, Lino Sanfilippo wrote: > Hi, > > On 03.12.2016 14:24, Pan Bian wrote: > > From: Pan Bian > > > > In function typhoon_init_one(), returns the value of variable err on > > errors. However,

  1   2   3   >