Commit f2c6f180 authored by Maurizio Lombardi's avatar Maurizio Lombardi Committed by Christoph Hellwig

pm8001: Fix potential null pointer dereference and memory leak.

The pm8001_get_phy_settings_info() function does not check
the kzalloc() return value and does not free the allocated memory.
Signed-off-by: default avatarMaurizio Lombardi <mlombard@redhat.com>
Acked-by: default avatarSuresh Thiagarajan <Suresh.Thiagarajan@pmcs.com>
Acked-by: default avatarJack Wang <xjtuwjp@gmail.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent 3a980508
...@@ -677,7 +677,7 @@ static void pm8001_init_sas_add(struct pm8001_hba_info *pm8001_ha) ...@@ -677,7 +677,7 @@ static void pm8001_init_sas_add(struct pm8001_hba_info *pm8001_ha)
* pm8001_get_phy_settings_info : Read phy setting values. * pm8001_get_phy_settings_info : Read phy setting values.
* @pm8001_ha : our hba. * @pm8001_ha : our hba.
*/ */
void pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha) static int pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
{ {
#ifdef PM8001_READ_VPD #ifdef PM8001_READ_VPD
...@@ -691,11 +691,15 @@ void pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha) ...@@ -691,11 +691,15 @@ void pm8001_get_phy_settings_info(struct pm8001_hba_info *pm8001_ha)
payload.offset = 0; payload.offset = 0;
payload.length = 4096; payload.length = 4096;
payload.func_specific = kzalloc(4096, GFP_KERNEL); payload.func_specific = kzalloc(4096, GFP_KERNEL);
if (!payload.func_specific)
return -ENOMEM;
/* Read phy setting values from flash */ /* Read phy setting values from flash */
PM8001_CHIP_DISP->get_nvmd_req(pm8001_ha, &payload); PM8001_CHIP_DISP->get_nvmd_req(pm8001_ha, &payload);
wait_for_completion(&completion); wait_for_completion(&completion);
pm8001_set_phy_profile(pm8001_ha, sizeof(u8), payload.func_specific); pm8001_set_phy_profile(pm8001_ha, sizeof(u8), payload.func_specific);
kfree(payload.func_specific);
#endif #endif
return 0;
} }
#ifdef PM8001_USE_MSIX #ifdef PM8001_USE_MSIX
...@@ -879,8 +883,11 @@ static int pm8001_pci_probe(struct pci_dev *pdev, ...@@ -879,8 +883,11 @@ static int pm8001_pci_probe(struct pci_dev *pdev,
pm8001_init_sas_add(pm8001_ha); pm8001_init_sas_add(pm8001_ha);
/* phy setting support for motherboard controller */ /* phy setting support for motherboard controller */
if (pdev->subsystem_vendor != PCI_VENDOR_ID_ADAPTEC2 && if (pdev->subsystem_vendor != PCI_VENDOR_ID_ADAPTEC2 &&
pdev->subsystem_vendor != 0) pdev->subsystem_vendor != 0) {
pm8001_get_phy_settings_info(pm8001_ha); rc = pm8001_get_phy_settings_info(pm8001_ha);
if (rc)
goto err_out_shost;
}
pm8001_post_sas_ha_init(shost, chip); pm8001_post_sas_ha_init(shost, chip);
rc = sas_register_ha(SHOST_TO_SAS_HA(shost)); rc = sas_register_ha(SHOST_TO_SAS_HA(shost));
if (rc) if (rc)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment