diff options
| author | Dan Carpenter <error27@gmail.com> | 2011-02-15 07:10:08 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2011-03-21 20:32:36 -0300 |
| commit | 07988007f8dd2827ba1eb39e6e3c5bbb29cfc30b (patch) | |
| tree | 9ddac7f907a90e7ca9e433122c058ecf80c82c77 /drivers | |
| parent | 57f05bfa2e90fe52fa36755f4cb91e6f495f8353 (diff) | |
[media] stv090x: handle allocation failures
kmalloc() can fail so check whether state->internal is NULL.
append_internal() can return NULL on allocation failures so check that.
Also if we hit the error condition later in the function then there is
a memory leak and we need to call remove_dev() to fix it.
Also Oliver Endriss pointed out an additional leak that I missed in the
first version of this patch.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/dvb/frontends/stv090x.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/media/dvb/frontends/stv090x.c b/drivers/media/dvb/frontends/stv090x.c index d3362d0407e..41d0f0a6655 100644 --- a/drivers/media/dvb/frontends/stv090x.c +++ b/drivers/media/dvb/frontends/stv090x.c @@ -4783,7 +4783,13 @@ struct dvb_frontend *stv090x_attach(const struct stv090x_config *config, } else { state->internal = kmalloc(sizeof(struct stv090x_internal), GFP_KERNEL); + if (!state->internal) + goto error; temp_int = append_internal(state->internal); + if (!temp_int) { + kfree(state->internal); + goto error; + } state->internal->num_used = 1; state->internal->mclk = 0; state->internal->dev_ver = 0; @@ -4796,7 +4802,7 @@ struct dvb_frontend *stv090x_attach(const struct stv090x_config *config, if (stv090x_setup(&state->frontend) < 0) { dprintk(FE_ERROR, 1, "Error setting up device"); - goto error; + goto err_remove; } } @@ -4811,6 +4817,9 @@ struct dvb_frontend *stv090x_attach(const struct stv090x_config *config, return &state->frontend; +err_remove: + remove_dev(state->internal); + kfree(state->internal); error: kfree(state); return NULL; |