Author: jhb
Date: Wed Sep 20 20:48:21 2017
New Revision: 323826
URL: https://svnweb.freebsd.org/changeset/base/323826
Log:
MFC 322270: Fix a NULL pointer dereference in mly_user_command().
If mly_user_command fails to allocate a command slot it jumps to an 'out'
label used for error handling. The error handling code checks for a data
buffer in 'mc->mc_data' to free before checking if 'mc' is NULL. Fix by
just returning directly if we fail to allocate a command and only using
the 'out' label for subsequent errors when there is actual cleanup to
perform.
PR: 217747
Reported by: PVS-Studio
Modified:
stable/10/sys/dev/mly/mly.c
Directory Properties:
stable/10/ (props changed)
Changes in other areas also in this revision:
Modified:
stable/11/sys/dev/mly/mly.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/10/sys/dev/mly/mly.c
==============================================================================
--- stable/10/sys/dev/mly/mly.c Wed Sep 20 20:40:49 2017 (r323825)
+++ stable/10/sys/dev/mly/mly.c Wed Sep 20 20:48:21 2017 (r323826)
@@ -2861,8 +2861,7 @@ mly_user_command(struct mly_softc *sc, struct mly_user
/* allocate a command */
if (mly_alloc_command(sc, &mc)) {
- error = ENOMEM;
- goto out; /* XXX Linux version will wait for a command */
+ return (ENOMEM); /* XXX Linux version will wait for a command */
}
/* handle data size/direction */
@@ -2918,8 +2917,7 @@ mly_user_command(struct mly_softc *sc, struct mly_user
out:
if (mc->mc_data != NULL)
free(mc->mc_data, M_DEVBUF);
- if (mc != NULL)
- mly_release_command(mc);
+ mly_release_command(mc);
return(error);
}
_______________________________________________
svn-src-stable-10@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10
To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"
