Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

powerpc/fsl_rio: Add kmalloc NULL tests

Check that the result of kmalloc/kzalloc is not NULL before dereferencing it.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression *x;
identifier f;
constant char *C;
@@

x = \(kmalloc\|kcalloc\|kzalloc\)(...);
... when != x == NULL
when != x != NULL
when != (x || ...)
(
kfree(x)
|
f(...,C,...,x,...)
|
*f(...,x,...)
|
*x->f
)
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

authored by

Julia Lawall and committed by
Benjamin Herrenschmidt
6c75933c 8dcd038a

+14 -4
+14 -4
arch/powerpc/sysdev/fsl_rio.c
··· 1057 1057 law_start, law_size); 1058 1058 1059 1059 ops = kmalloc(sizeof(struct rio_ops), GFP_KERNEL); 1060 + if (!ops) { 1061 + rc = -ENOMEM; 1062 + goto err_ops; 1063 + } 1060 1064 ops->lcread = fsl_local_config_read; 1061 1065 ops->lcwrite = fsl_local_config_write; 1062 1066 ops->cread = fsl_rio_config_read; ··· 1068 1064 ops->dsend = fsl_rio_doorbell_send; 1069 1065 1070 1066 port = kzalloc(sizeof(struct rio_mport), GFP_KERNEL); 1067 + if (!port) { 1068 + rc = -ENOMEM; 1069 + goto err_port; 1070 + } 1071 1071 port->id = 0; 1072 1072 port->index = 0; 1073 1073 ··· 1079 1071 if (!priv) { 1080 1072 printk(KERN_ERR "Can't alloc memory for 'priv'\n"); 1081 1073 rc = -ENOMEM; 1082 - goto err; 1074 + goto err_priv; 1083 1075 } 1084 1076 1085 1077 INIT_LIST_HEAD(&port->dbells); ··· 1177 1169 1178 1170 return 0; 1179 1171 err: 1180 - if (priv) 1181 - iounmap(priv->regs_win); 1182 - kfree(ops); 1172 + iounmap(priv->regs_win); 1183 1173 kfree(priv); 1174 + err_priv: 1184 1175 kfree(port); 1176 + err_port: 1177 + kfree(ops); 1178 + err_ops: 1185 1179 return rc; 1186 1180 } 1187 1181