mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-21 23:32:35 +07:00
0e7bf23e49
In ath6kl_htc_mbox_create(), when kzalloc() on line 2855 fails,
target->dev is assigned to NULL, and ath6kl_htc_mbox_cleanup(target) is
called on line 2885.
In ath6kl_htc_mbox_cleanup(), target->dev is used on line 2895:
ath6kl_hif_cleanup_scatter(target->dev->ar);
Thus, a null-pointer dereference may occur.
To fix this bug, kfree(target) is called and NULL is returned when
kzalloc() on line 2855 fails.
This bug is found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||
|---|---|---|
| .. | ||
| bmi.c | ||
| bmi.h | ||
| cfg80211.c | ||
| cfg80211.h | ||
| common.h | ||
| core.c | ||
| core.h | ||
| debug.c | ||
| debug.h | ||
| hif-ops.h | ||
| hif.c | ||
| hif.h | ||
| htc_mbox.c | ||
| htc_pipe.c | ||
| htc-ops.h | ||
| htc.h | ||
| init.c | ||
| Kconfig | ||
| main.c | ||
| Makefile | ||
| recovery.c | ||
| sdio.c | ||
| target.h | ||
| testmode.c | ||
| testmode.h | ||
| trace.c | ||
| trace.h | ||
| txrx.c | ||
| usb.c | ||
| wmi.c | ||
| wmi.h | ||