Author: jhb
Date: Tue Aug 8 17:49:57 2017
New Revision: 322270
URL: https://svnweb.freebsd.org/changeset/base/322270
Log:
Fix a NULL pointer dereference in mly_user_command().
If mly_user_command fails to allocate a command slot it jumps to an 'out'
label used for error handling. The error handling code checks for a data
buffer in 'mc->mc_data' to free before checking if 'mc' is NULL. Fix by
just returning directly if we fail to allocate a command and only using
the 'out' label for subsequent errors when there is actual cleanup to
perform.
PR: 217747
Reported by: PVS-Studio
Reviewed by: emaste
MFC after: 1 week
Modified:
head/sys/dev/mly/mly.c
Modified: head/sys/dev/mly/mly.c
==============================================================================
--- head/sys/dev/mly/mly.c Tue Aug 8 17:26:19 2017 (r322269)
+++ head/sys/dev/mly/mly.c Tue Aug 8 17:49:57 2017 (r322270)
@@ -2892,8 +2892,7 @@ mly_user_command(struct mly_softc *sc, struct mly_user
MLY_LOCK(sc);
if (mly_alloc_command(sc, &mc)) {
MLY_UNLOCK(sc);
- error = ENOMEM;
- goto out; /* XXX Linux version will wait for a command */
+ return (ENOMEM); /* XXX Linux version will wait for a command */
}
MLY_UNLOCK(sc);
@@ -2952,11 +2951,9 @@ mly_user_command(struct mly_softc *sc, struct mly_user
out:
if (mc->mc_data != NULL)
free(mc->mc_data, M_DEVBUF);
- if (mc != NULL) {
- MLY_LOCK(sc);
- mly_release_command(mc);
- MLY_UNLOCK(sc);
- }
+ MLY_LOCK(sc);
+ mly_release_command(mc);
+ MLY_UNLOCK(sc);
return(error);
}
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
