Dan Carpenter <error27@xxxxxxxxx> wrote: > The "goto cleanup" path can dereference "rswitch" which is NULL here. > > Signed-off-by: Dan Carpenter <error27@xxxxxxxxx> > --- > This is sort of embarrassing, I've patched this function before but > missed this. Hopefully it's right now. > > diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c > index 0914f49..882cef9 100644 > --- a/drivers/rapidio/rio-scan.c > +++ b/drivers/rapidio/rio-scan.c > @@ -432,7 +432,7 @@ static struct rio_dev __devinit > *rio_setup_device(struct rio_net *net, > /* Assign component tag to device */ > if (next_comptag >= 0x10000) { > pr_err("RIO: Component Tag Counter Overflow\n"); > - goto cleanup; > + goto out_rdev; > } > rio_mport_write_config_32(port, destid, hopcount, > RIO_COMPONENT_TAG_CSR, next_comptag); > @@ -518,7 +518,7 @@ static struct rio_dev __devinit > *rio_setup_device(struct rio_net *net, > cleanup: > if (rio_is_switch(rdev)) > kfree(rswitch->route_table); Because rswitch is set not-NULL only for switch devices the check below can make things simpler: cleanup: if (rswitch) kfree(rswitch->route_table); > - > +out_rdev: > kfree(rdev); > return NULL; > } -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html