提交 a6c0f821 编写于 作者: D Denis Kirjanov 提交者: David S. Miller

ieee802154: Fix possible NULL pointer dereference in wpan_phy_alloc

Check for NULL pointer after kzalloc
Signed-off-by: NDenis Kirjanov <dkirjanov@kernel.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 418c437d
...@@ -147,13 +147,15 @@ struct wpan_phy *wpan_phy_alloc(size_t priv_size) ...@@ -147,13 +147,15 @@ struct wpan_phy *wpan_phy_alloc(size_t priv_size)
struct wpan_phy *phy = kzalloc(sizeof(*phy) + priv_size, struct wpan_phy *phy = kzalloc(sizeof(*phy) + priv_size,
GFP_KERNEL); GFP_KERNEL);
if (!phy)
goto out;
mutex_lock(&wpan_phy_mutex); mutex_lock(&wpan_phy_mutex);
phy->idx = wpan_phy_idx++; phy->idx = wpan_phy_idx++;
if (unlikely(!wpan_phy_idx_valid(phy->idx))) { if (unlikely(!wpan_phy_idx_valid(phy->idx))) {
wpan_phy_idx--; wpan_phy_idx--;
mutex_unlock(&wpan_phy_mutex); mutex_unlock(&wpan_phy_mutex);
kfree(phy); kfree(phy);
return NULL; goto out;
} }
mutex_unlock(&wpan_phy_mutex); mutex_unlock(&wpan_phy_mutex);
...@@ -168,6 +170,9 @@ struct wpan_phy *wpan_phy_alloc(size_t priv_size) ...@@ -168,6 +170,9 @@ struct wpan_phy *wpan_phy_alloc(size_t priv_size)
phy->current_page = 0; /* for compatibility */ phy->current_page = 0; /* for compatibility */
return phy; return phy;
out:
return NULL;
} }
EXPORT_SYMBOL(wpan_phy_alloc); EXPORT_SYMBOL(wpan_phy_alloc);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册