On 9/12/22 19:04, Nam Cao wrote:
In some initialization functions of this driver, memory is allocated with 'i' acting as an index variable and increasing from 0. The commit in "Fixes" introduces some clean-up codes in case of allocation failure, which free memory in reverse order with 'i' decreasing to 0. However, there are some problems: - The case i=0 is left out. Thus memory is leaked. - In case memory allocation fails right from the start, the memory freeing loops will start with i=-1 and invalid memory locations will be accessed. One of these loops has been fixed in commit c8ff91535880 ("staging: vt6655: fix potential memory leak"). Fix the remaining erroneous loops. Link: https://lore.kernel.org/linux-staging/Yx9H1zSpxmNqx6Xc@kadam/ Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> Fixes: 5341ee0adb17 ("staging: vt6655: check for memory allocation failures") Signed-off-by: Nam Cao <namcaov@xxxxxxxxx> --- drivers/staging/vt6655/device_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c index 04d737012cef..56c3cf3ba53d 100644 --- a/drivers/staging/vt6655/device_main.c +++ b/drivers/staging/vt6655/device_main.c @@ -631,7 +631,7 @@ static int device_init_rd0_ring(struct vnt_private *priv) kfree(desc->rd_info);err_free_desc:- while (--i) { + while (i--) { desc = &priv->aRD0Ring[i]; device_free_rx_buf(priv, desc); kfree(desc->rd_info); @@ -677,7 +677,7 @@ static int device_init_rd1_ring(struct vnt_private *priv) kfree(desc->rd_info);err_free_desc:- while (--i) { + while (i--) { desc = &priv->aRD1Ring[i]; device_free_rx_buf(priv, desc); kfree(desc->rd_info); @@ -782,7 +782,7 @@ static int device_init_td1_ring(struct vnt_private *priv) return 0;err_free_desc:- while (--i) { + while (i--) { desc = &priv->apTD1Rings[i]; kfree(desc->td_info); }
Tested-by: Philipp Hortmann <philipp.g.hortmann@xxxxxxxxx>
