Skip to content

L
linux
Commit ae7acefc authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files
Options

[PATCH] Compaq PCI Hotplug: fix checker memory leak bugs.

parent dc2d7266
Show whitespace changes
Inline Side-by-side
Showing with 40 additions and 27 deletions
drivers/hotplug/cpqphp_nvram.c
View file @ ae7acefc
...@@ -473,7 +473,7 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -473,7 +473,7 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
p_byte += 3; p_byte += 3;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length))
return(2); return 2;
bus = p_ev_ctrl->bus; bus = p_ev_ctrl->bus;
device = p_ev_ctrl->device; device = p_ev_ctrl->device;
...@@ -490,20 +490,20 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -490,20 +490,20 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length))
return(2); return 2;
// Skip forward to the next entry // Skip forward to the next entry
p_byte += (nummem + numpmem + numio + numbus) * 8; p_byte += (nummem + numpmem + numio + numbus) * 8;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length))
return(2); return 2;
p_ev_ctrl = (struct ev_hrt_ctrl *) p_byte; p_ev_ctrl = (struct ev_hrt_ctrl *) p_byte;
p_byte += 3; p_byte += 3;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length))
return(2); return 2;
bus = p_ev_ctrl->bus; bus = p_ev_ctrl->bus;
device = p_ev_ctrl->device; device = p_ev_ctrl->device;
...@@ -518,7 +518,7 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -518,7 +518,7 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length))
return(2); return 2;
while (nummem--) { while (nummem--) {
mem_node = (struct pci_resource*) kmalloc(sizeof(struct pci_resource), GFP_KERNEL); mem_node = (struct pci_resource*) kmalloc(sizeof(struct pci_resource), GFP_KERNEL);
...@@ -530,15 +530,19 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -530,15 +530,19 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
dbg("mem base = %8.8x\n",mem_node->base); dbg("mem base = %8.8x\n",mem_node->base);
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
return(2); kfree(mem_node);
return 2;
}
mem_node->length = *(u32*)p_byte; mem_node->length = *(u32*)p_byte;
dbg("mem length = %8.8x\n",mem_node->length); dbg("mem length = %8.8x\n",mem_node->length);
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
return(2); kfree(mem_node);
return 2;
}
mem_node->next = ctrl->mem_head; mem_node->next = ctrl->mem_head;
ctrl->mem_head = mem_node; ctrl->mem_head = mem_node;
...@@ -554,15 +558,19 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -554,15 +558,19 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
dbg("pre-mem base = %8.8x\n",p_mem_node->base); dbg("pre-mem base = %8.8x\n",p_mem_node->base);
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
return(2); kfree(p_mem_node);
return 2;
}
p_mem_node->length = *(u32*)p_byte; p_mem_node->length = *(u32*)p_byte;
dbg("pre-mem length = %8.8x\n",p_mem_node->length); dbg("pre-mem length = %8.8x\n",p_mem_node->length);
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
return(2); kfree(p_mem_node);
return 2;
}
p_mem_node->next = ctrl->p_mem_head; p_mem_node->next = ctrl->p_mem_head;
ctrl->p_mem_head = p_mem_node; ctrl->p_mem_head = p_mem_node;
...@@ -578,15 +586,19 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -578,15 +586,19 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
dbg("io base = %8.8x\n",io_node->base); dbg("io base = %8.8x\n",io_node->base);
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
return(2); kfree(io_node);
return 2;
}
io_node->length = *(u32*)p_byte; io_node->length = *(u32*)p_byte;
dbg("io length = %8.8x\n",io_node->length); dbg("io length = %8.8x\n",io_node->length);
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
return(2); kfree(io_node);
return 2;
}
io_node->next = ctrl->io_head; io_node->next = ctrl->io_head;
ctrl->io_head = io_node; ctrl->io_head = io_node;
...@@ -601,15 +613,18 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -601,15 +613,18 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
bus_node->base = *(u32*)p_byte; bus_node->base = *(u32*)p_byte;
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
return(2); kfree(bus_node);
return 2;
}
bus_node->length = *(u32*)p_byte; bus_node->length = *(u32*)p_byte;
p_byte += 4; p_byte += 4;
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) {
if (p_byte > ((u8*)p_EV_header + evbuffer_length)) kfree(bus_node);
return(2); return 2;
}
bus_node->next = ctrl->bus_head; bus_node->next = ctrl->bus_head;
ctrl->bus_head = bus_node; ctrl->bus_head = bus_node;
...@@ -623,13 +638,11 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl) ...@@ -623,13 +638,11 @@ int compaq_nvram_load (void *rom_start, struct controller *ctrl)
rc &= cpqhp_resource_sort_and_combine(&(ctrl->io_head)); rc &= cpqhp_resource_sort_and_combine(&(ctrl->io_head));
rc &= cpqhp_resource_sort_and_combine(&(ctrl->bus_head)); rc &= cpqhp_resource_sort_and_combine(&(ctrl->bus_head));
if (rc) { if (rc)
return(rc); return(rc);
}
} else { } else {
if ((evbuffer[0] != 0) && (!ctrl->push_flag)) { if ((evbuffer[0] != 0) && (!ctrl->push_flag))
return(1); return 1;
}
} }
return 0; return 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7