ipheth: potential null dereferences on error path

svn path=/dists/sid/linux-2.6/; revision=15583

debian/patches/bugfix/all/ipheth-potential-null-dereferences-on-error-path.patch

@@ -0,0 +1,73 @@
+From d87ff58fda926fe5cb01214cccf1c72422ac776d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Mon, 26 Apr 2010 23:20:12 +0000
+Subject: [PATCH] ipheth: potential null dereferences on error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The calls to usb_free_buffer() dereference rx_urb and tx_urb in the
+parameter list but those could be NULL.
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Acked-by: L. Alberto Giménez <agimenez@sysvalve.es>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/usb/ipheth.c |   15 ++++++++-------
+ 1 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index fd10331..418825d 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -122,25 +122,25 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+ 
+ 	tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+ 	if (tx_urb == NULL)
+-		goto error;
++		goto error_nomem;
+ 
+ 	rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+ 	if (rx_urb == NULL)
+-		goto error;
++		goto free_tx_urb;
+ 
+ 	tx_buf = usb_buffer_alloc(iphone->udev,
+ 				  IPHETH_BUF_SIZE,
+ 				  GFP_KERNEL,
+ 				  &tx_urb->transfer_dma);
+ 	if (tx_buf == NULL)
+-		goto error;
++		goto free_rx_urb;
+ 
+ 	rx_buf = usb_buffer_alloc(iphone->udev,
+ 				  IPHETH_BUF_SIZE,
+ 				  GFP_KERNEL,
+ 				  &rx_urb->transfer_dma);
+ 	if (rx_buf == NULL)
+-		goto error;
++		goto free_tx_buf;
+ 
+ 
+ 	iphone->tx_urb = tx_urb;
+@@ -149,13 +149,14 @@ static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+ 	iphone->rx_buf = rx_buf;
+ 	return 0;
+ 
+-error:
+-	usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
+-			rx_urb->transfer_dma);
++free_tx_buf:
+ 	usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+ 			tx_urb->transfer_dma);
++free_rx_urb:
+ 	usb_free_urb(rx_urb);
++free_tx_urb:
+ 	usb_free_urb(tx_urb);
++error_nomem:
+ 	return -ENOMEM;
+ }
+ 
+-- 
+1.7.0.3
+

debian/patches/series/12

@@ -25,6 +25,7 @@
 + bugfix/all/stable/2.6.32.12.patch
 + bugfix/all/stable/2.6.33.3.patch
 + features/all/ipheth-add.patch
++ bugfix/all/ipheth-potential-null-dereferences-on-error-path.patch
 + bugfix/all/libata-fix-accesses-at-LBA28-boundary.patch
 + bugfix/all/thinkpad-acpi-add-x100e.patch
 + bugfix/all/hrtimer-tune-hrtimer_interrupt-hang-logic.patch