Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965375AbeALVpF (ORCPT + 1 other); Fri, 12 Jan 2018 16:45:05 -0500 Received: from smtp09.smtpout.orange.fr ([80.12.242.131]:44430 "EHLO smtp.smtpout.orange.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965256AbeALVo7 (ORCPT ); Fri, 12 Jan 2018 16:44:59 -0500 X-ME-Helo: localhost.localdomain X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI= X-ME-Date: Fri, 12 Jan 2018 22:44:58 +0100 X-ME-IP: 90.107.118.99 From: Christophe JAILLET To: balbi@kernel.org, gregkh@linuxfoundation.org, bhumirks@gmail.com, leoyang.li@nxp.com Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org, Christophe JAILLET Subject: [PATCH 4/4] usb: gadget: fotg210-udc: Fix a potential invalid pointer dereference Date: Fri, 12 Jan 2018 22:44:33 +0100 Message-Id: <401ba0ff47de1c12c0798ed38fc9b0124f5de269.1515791144.git.christophe.jaillet@wanadoo.fr> X-Mailer: git-send-email 2.14.1 In-Reply-To: <0c3925c9ee4e56cd819347ab9ec515011b54d0ae.1515791144.git.christophe.jaillet@wanadoo.fr> References: <0c3925c9ee4e56cd819347ab9ec515011b54d0ae.1515791144.git.christophe.jaillet@wanadoo.fr> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: We should not call 'fotg210_ep_free_request()' with NULL as a 2nd parameter. Depending of the layout of 'struct fotg210_request', this could lead to an un-expected behavior. So, if 'fotg210_ep_alloc_request()' fails, we should return directly. This also gives the opportunity to further simplify code. (In fact, this change should be a no-op, because 'req' is the first field of 'struct fotg210_request'. So passing NULL would result in 'free(NULL)' in 'fotg210_ep_free_request()'. Anyway avoiding the goto is cleaner.) Signed-off-by: Christophe JAILLET --- drivers/usb/gadget/udc/fotg210-udc.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c index 99a18b14c8c2..03adfcb58548 100644 --- a/drivers/usb/gadget/udc/fotg210-udc.c +++ b/drivers/usb/gadget/udc/fotg210-udc.c @@ -1075,8 +1075,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) { struct resource *res, *ires; struct fotg210_udc *fotg210 = NULL; - int ret = 0; - int i; + int ret, i; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!res) { @@ -1090,8 +1089,6 @@ static int fotg210_udc_probe(struct platform_device *pdev) return -ENODEV; } - ret = -ENOMEM; - /* initialize udc */ fotg210 = devm_kzalloc(&pdev->dev, sizeof(struct fotg210_udc), GFP_KERNEL); @@ -1155,8 +1152,8 @@ static int fotg210_udc_probe(struct platform_device *pdev) fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep, GFP_KERNEL); - if (fotg210->ep0_req == NULL) - goto err_req; + if (!fotg210->ep0_req) + return -ENOMEM; fotg210_init(fotg210); -- 2.14.1