There are two allocations where, if they fail, then we end up dereferencing the NULL pointer in the error handling code. Fixes: 94885faf9dbc ('clk: st: Support for DIVMUX and PreDiv Clocks') Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> diff --git a/drivers/clk/st/clkgen-mux.c b/drivers/clk/st/clkgen-mux.c index a329906..10899bc 100644 --- a/drivers/clk/st/clkgen-mux.c +++ b/drivers/clk/st/clkgen-mux.c @@ -714,14 +714,14 @@ void __init st_of_clkgen_vcc_setup(struct device_node *np) clk_data = kzalloc(sizeof(*clk_data), GFP_KERNEL); if (!clk_data) - goto err; + goto err_free_parents; clk_data->clk_num = VCC_MAX_CHANNELS; clk_data->clks = kzalloc(clk_data->clk_num * sizeof(struct clk *), GFP_KERNEL); if (!clk_data->clks) - goto err; + goto err_free_data; for (i = 0; i < clk_data->clk_num; i++) { struct clk *clk; @@ -811,10 +811,11 @@ err: kfree(container_of(composite->mux_hw, struct clk_mux, hw)); } - if (clk_data) - kfree(clk_data->clks); + kfree(clk_data->clks); +err_free_data: kfree(clk_data); +err_free_parents: kfree(parents); } CLK_OF_DECLARE(clkgen_vcc, "st,clkgen-vcc", st_of_clkgen_vcc_setup); -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html