From: Nicholas Mc Guire <hof...@osadl.org>

[ Upstream commit c5d59528e24ad22500347b199d52b9368e686a42 ]

altera_hw_filt_init() which calls append_internal() assumes
that the node was successfully linked in while in fact it can
silently fail. So the call-site needs to set return to -ENOMEM
on append_internal() returning NULL and exit through the err path.

Fixes: 349bcf02e361 ("[media] Altera FPGA based CI driver module")

Signed-off-by: Nicholas Mc Guire <hof...@osadl.org>
Signed-off-by: Hans Verkuil <hans.verk...@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+sams...@kernel.org>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/media/pci/cx23885/altera-ci.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/media/pci/cx23885/altera-ci.c 
b/drivers/media/pci/cx23885/altera-ci.c
index 62bc8049b320..198c05e83f5c 100644
--- a/drivers/media/pci/cx23885/altera-ci.c
+++ b/drivers/media/pci/cx23885/altera-ci.c
@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config 
*config, int hw_filt_nr)
                }
 
                temp_int = append_internal(inter);
+               if (!temp_int) {
+                       ret = -ENOMEM;
+                       goto err;
+               }
                inter->filts_used = 1;
                inter->dev = config->dev;
                inter->fpga_rw = config->fpga_rw;
@@ -699,6 +703,7 @@ static int altera_hw_filt_init(struct altera_ci_config 
*config, int hw_filt_nr)
                     __func__, ret);
 
        kfree(pid_filt);
+       kfree(inter);
 
        return ret;
 }
@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int 
ci_nr)
                }
 
                temp_int = append_internal(inter);
+               if (!temp_int) {
+                       ret = -ENOMEM;
+                       goto err;
+               }
                inter->cis_used = 1;
                inter->dev = config->dev;
                inter->fpga_rw = config->fpga_rw;
@@ -801,6 +810,7 @@ int altera_ci_init(struct altera_ci_config *config, int 
ci_nr)
        ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret);
 
        kfree(state);
+       kfree(inter);
 
        return ret;
 }
-- 
2.17.1

Reply via email to