summaryrefslogtreecommitdiffstats
path: root/drivers/staging/android
diff options
context:
space:
mode:
authorJohn Stultz <john.stultz@linaro.org>2013-12-16 21:07:52 -0800
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-12-17 08:57:21 -0800
commitf4ea823be2ca9e61522de002804c9a7a54c9be16 (patch)
treed2112af9d59654f5f8b36588e5404cea256f19cb /drivers/staging/android
parent679bcc935c4ed45e3f9c56f5d0c766b0844c93a9 (diff)
staging: ion: Fix possible null pointer dereference
The kbuild test robot reported: drivers/staging/android/ion/ion_system_heap.c:122 alloc_largest_available() error: potential null dereference 'info'. (kmalloc returns null) Where the pointer returned from kmalloc goes unchecked for failure. This patch checks the return for NULL, and reworks the logic, as suggested by Colin, so we allocate the page_info structure first. Acked-by: Colin Cross <ccross@android.com> Cc: Android Kernel Team <kernel-team@android.com> Reported-by: kbuild test robot <fengguang.wu@intel.com> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/android')
-rw-r--r--drivers/staging/android/ion/ion_system_heap.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c
index 144b2272750..7f0729130d6 100644
--- a/drivers/staging/android/ion/ion_system_heap.c
+++ b/drivers/staging/android/ion/ion_system_heap.c
@@ -108,6 +108,10 @@ static struct page_info *alloc_largest_available(struct ion_system_heap *heap,
struct page_info *info;
int i;
+ info = kmalloc(sizeof(struct page_info), GFP_KERNEL);
+ if (!info)
+ return NULL;
+
for (i = 0; i < num_orders; i++) {
if (size < order_to_size(orders[i]))
continue;
@@ -118,11 +122,12 @@ static struct page_info *alloc_largest_available(struct ion_system_heap *heap,
if (!page)
continue;
- info = kmalloc(sizeof(struct page_info), GFP_KERNEL);
info->page = page;
info->order = orders[i];
return info;
}
+ kfree(info);
+
return NULL;
}