From: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
Date: Tue, 26 Jul 2016 14:10:55 +0200
The kfree() function was called in up to three cases by the
class_register_type() function during error handling even if
the passed data structure element contained a null pointer.
* Split a condition check for memory allocation failures.
* Improve this implementation detail by the introduction of a few
jump labels.
Signed-off-by: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
---
drivers/staging/lustre/lustre/obdclass/genops.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/drivers/staging/lustre/lustre/obdclass/genops.c b/drivers/staging/lustre/lustre/obdclass/genops.c
index 10dd145..fd5e61f 100644
--- a/drivers/staging/lustre/lustre/obdclass/genops.c
+++ b/drivers/staging/lustre/lustre/obdclass/genops.c
@@ -158,13 +158,22 @@ int class_register_type(struct obd_ops *dt_ops, struct md_ops *md_ops,
return rc;
type->typ_dt_ops = kzalloc(sizeof(*type->typ_dt_ops), GFP_NOFS);
+ if (!type->typ_dt_ops) {
+ rc = -ENOMEM;
+ goto free_type;
+ }
+
type->typ_md_ops = kzalloc(sizeof(*type->typ_md_ops), GFP_NOFS);
- type->typ_name = kzalloc(strlen(name) + 1, GFP_NOFS);
+ if (!type->typ_dt_ops) {
+ rc = -ENOMEM;
+ goto free_dt_ops;
+ }
- if (!type->typ_dt_ops ||
- !type->typ_md_ops ||
- !type->typ_name)
- goto free_name;
+ type->typ_name = kzalloc(strlen(name) + 1, GFP_NOFS);
+ if (!type->typ_name) {
+ rc = -ENOMEM;
+ goto free_md_ops;
+ }
*(type->typ_dt_ops) = *dt_ops;
/* md_ops is optional */
@@ -205,8 +214,11 @@ put_object:
kobject_put(type->typ_kobj);
free_name:
kfree(type->typ_name);
+free_md_ops:
kfree(type->typ_md_ops);
+free_dt_ops:
kfree(type->typ_dt_ops);
+free_type:
kfree(type);
return rc;
}
--
2.9.2
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
