浏览代码

fec_mxc: incomplete error handling

fec_init() will only allocate fec->base_ptr if it is non-NULL. But
the cleanup routine on error will free the pointer without setting
it to NULL. This means that a later call to fec_init() would result
in using an invalid pointer.

Signed-off-by: John Ogness <john.ogness@linutronix.de>
Signed-off-by: Ben Warren <biggerbadderben@gmail.com>
John Ogness 15 年之前
父节点
当前提交
c179a2896e
共有 1 个文件被更改,包括 1 次插入0 次删除
  1. 1 0
      drivers/net/fec_mxc.c

+ 1 - 0
drivers/net/fec_mxc.c

@@ -450,6 +450,7 @@ static int fec_init(struct eth_device *dev, bd_t* bd)
 	 */
 	if (fec_rbd_init(fec, FEC_RBD_NUM, FEC_MAX_PKT_SIZE) < 0) {
 		free(fec->base_ptr);
+		fec->base_ptr = NULL;
 		return -ENOMEM;
 	}
 	fec_tbd_init(fec);