linux-kernel - [PATCH] usbtmc: don't return zero on failure path in usbtmc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1489793880-14284-1-git-send-email-khoroshilov@ispras.ru>
Date:   Sat, 18 Mar 2017 02:38:00 +0300
From:   Alexey Khoroshilov <khoroshilov@...ras.ru>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Wolfram Sang <wsa-dev@...g-engineering.com>,
        Dave Penkler <dpenkler@...il.com>
Cc:     Alexey Khoroshilov <khoroshilov@...ras.ru>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        ldv-project@...uxtesting.org
Subject: [PATCH] usbtmc: don't return zero on failure path in usbtmc_probe()

usbtmc_probe() returns zero in case of allocation failures.

The patch fixes that. By the way it rearranges error lables just to improve
readability of quite complex dependencies in error handling code.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>
---
 drivers/usb/class/usbtmc.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index f03692ec5520..38fc3fd3727e 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1469,8 +1469,10 @@ static int usbtmc_probe(struct usb_interface *intf,
 	if (data->iin_ep_present) {
 		/* allocate int urb */
 		data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
-		if (!data->iin_urb)
-			goto error_register;
+		if (!data->iin_urb) {
+			retcode = -ENOMEM;
+			goto err_alloc_urb;
+		}
 
 		/* Protect interrupt in endpoint data until iin_urb is freed */
 		kref_get(&data->kref);
@@ -1478,8 +1480,10 @@ static int usbtmc_probe(struct usb_interface *intf,
 		/* allocate buffer for interrupt in */
 		data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
 					GFP_KERNEL);
-		if (!data->iin_buffer)
-			goto error_register;
+		if (!data->iin_buffer) {
+			retcode = -ENOMEM;
+			goto err_data;
+		}
 
 		/* fill interrupt urb */
 		usb_fill_int_urb(data->iin_urb, data->usb_dev,
@@ -1491,7 +1495,7 @@ static int usbtmc_probe(struct usb_interface *intf,
 		retcode = usb_submit_urb(data->iin_urb, GFP_KERNEL);
 		if (retcode) {
 			dev_err(&intf->dev, "Failed to submit iin_urb\n");
-			goto error_register;
+			goto err_data;
 		}
 	}
 
@@ -1502,16 +1506,18 @@ static int usbtmc_probe(struct usb_interface *intf,
 		dev_err(&intf->dev, "Not able to get a minor"
 			" (base %u, slice default): %d\n", USBTMC_MINOR_BASE,
 			retcode);
-		goto error_register;
+		goto err_register;
 	}
 	dev_dbg(&intf->dev, "Using minor number %d\n", intf->minor);
 
 	return 0;
 
-error_register:
-	sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
+err_register:
 	sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
+err_data:
 	usbtmc_free_int(data);
+err_alloc_urb:
+	sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
 	kref_put(&data->kref, usbtmc_delete);
 	return retcode;
 }
-- 
2.7.4