USB: gadget: ether: Clean up req->buf to avoid wild pointer
When OOM, the req->buf will fail to get memory from kmalloc.
And all the req->buf in dev->tx_reqs will be freed in the
error handler. But they are not cleared to NULL. So they are
not allocated while below function got called again.
int alloc_tx_buffer(struct eth_dev *dev)
{
list_for_each(act, &dev->tx_reqs) {
if ((!req->buf) ->3. it can't allocate again.
req->buf = kmalloc();->1. it fails to get memory as OOM.
if (!req->buf)
goto free_buf;
...
}
return 0;
free_buf:
...
kfree(req->buf); ->2. It's freed.
return -ENOMEM;
}
So these pointers will be freed multi times. What's worse,
once they are used as normally, system maybe be panic due to
wild pointer.
CRs-fixed: 571628
Change-Id: I96eb21553eb4840c02331d68056ea0eca9a25552
Signed-off-by: Figo Wang <figow@codeaurora.org>>
1 file changed