| Message ID | 20190311071022.27610-1-kjlu@umn.edu |
|---|---|
| State | Changes Requested |
| Delegated to: | David Miller |
| Headers | show |
| Series | net: fjes: fix potential NULL pointer dereferences | expand |
From: Kangjie Lu <kjlu@umn.edu> Date: Mon, 11 Mar 2019 02:10:21 -0500 > adapter->control_wq = alloc_workqueue(DRV_NAME "/control", > WQ_MEM_RECLAIM, 0); > + if (!adapter->control_wq) { > + err = -ENOMEM; > + goto err_free_netdev; > + } This error path leaks adapter->txrx_wq.
> On Mar 11, 2019, at 6:19 PM, David Miller <davem@davemloft.net> wrote: > > From: Kangjie Lu <kjlu@umn.edu> > Date: Mon, 11 Mar 2019 02:10:21 -0500 > >> adapter->control_wq = alloc_workqueue(DRV_NAME "/control", >> WQ_MEM_RECLAIM, 0); >> + if (!adapter->control_wq) { >> + err = -ENOMEM; >> + goto err_free_netdev; >> + } > > This error path leaks adapter->txrx_wq. The following code also has an error-handling case: goto err_free_netdev. Shouldn’t the resource release be in err_free_netdev? >
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c index d3eae1239045..18c2c9e24c24 100644 --- a/drivers/net/fjes/fjes_main.c +++ b/drivers/net/fjes/fjes_main.c @@ -1252,8 +1252,17 @@ static int fjes_probe(struct platform_device *plat_dev) adapter->open_guard = false; adapter->txrx_wq = alloc_workqueue(DRV_NAME "/txrx", WQ_MEM_RECLAIM, 0); + if (!adapter->txrx_wq) { + err = -ENOMEM; + goto err_free_netdev; + } + adapter->control_wq = alloc_workqueue(DRV_NAME "/control", WQ_MEM_RECLAIM, 0); + if (!adapter->control_wq) { + err = -ENOMEM; + goto err_free_netdev; + } INIT_WORK(&adapter->tx_stall_task, fjes_tx_stall_task); INIT_WORK(&adapter->raise_intr_rxdata_task,
In case alloc_workqueue fails, the fix returns -ENOMEM to avoid ULL pointer dereferences. Signed-off-by: Kangjie Lu <kjlu@umn.edu> --- drivers/net/fjes/fjes_main.c | 9 +++++++++ 1 file changed, 9 insertions(+)