![]() In drivers/net/usb/hso.c::hso_create_bulk_serial_device() we have this code: ... serial = kzalloc(sizeof(*serial), GFP_KERNEL); if (!serial) goto exit; ... exit: hso_free_tiomget(serial); ... hso_free_tiomget() directly dereferences its argument, which in the example above is a NULL pointer, ouch. I could just add a 'if (serial)' test at the 'exit' label, but since most freeing functions in the kernel accept NULL pointers (and it seems like this was also assumed here) I opted to instead change 'hso_free_tiomget()' so that it is safe to call it with a NULL argument. I also modified the function to get rid of a pointles conditional before the call to 'usb_free_urb()' since that function already tests for NULL itself - besides fixing the NULL deref this change also buys us a few bytes in size. Before: $ size drivers/net/usb/hso.o text data bss dec hex filename 32200 592 9960 42752 a700 drivers/net/usb/hso.o After: $ size drivers/net/usb/hso.o text data bss dec hex filename 32196 592 9960 42748 a6fc drivers/net/usb/hso.o Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
---|---|---|
.. | ||
Kconfig | ||
Makefile | ||
asix.c | ||
catc.c | ||
cdc-phonet.c | ||
cdc_eem.c | ||
cdc_ether.c | ||
cdc_ncm.c | ||
cdc_subset.c | ||
cx82310_eth.c | ||
dm9601.c | ||
gl620a.c | ||
hso.c | ||
int51x1.c | ||
ipheth.c | ||
kaweth.c | ||
mcs7830.c | ||
net1080.c | ||
pegasus.c | ||
pegasus.h | ||
plusb.c | ||
rndis_host.c | ||
rtl8150.c | ||
sierra_net.c | ||
smsc75xx.c | ||
smsc75xx.h | ||
smsc95xx.c | ||
smsc95xx.h | ||
usbnet.c | ||
zaurus.c |