--=_courier-31981-1052739452-0001-2
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
In ppp_generic.c:cardmap_set(), the return value from 2 kmalloc() calls
are not checked.
/fc
--=_courier-31981-1052739452-0001-2
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="cardmap_set.patch"
--- linux-2.4.20/drivers/net/ppp_generic.c.orig Fri Apr 25 02:02:14 2003
+++ linux-2.4.20/drivers/net/ppp_generic.c Fri Apr 25 02:21:36 2003
@@ -2270,17 +2270,20 @@ ppp_create_interface(int unit, int *retp
dev->priv = ppp;
dev->features |= NETIF_F_DYNALLOC;
+ if (ret = cardmap_set(&all_ppp_units, unit, ppp))
+ goto err_unlock;
+
rtnl_lock();
ret = register_netdevice(dev);
rtnl_unlock();
if (ret != 0) {
printk(KERN_ERR "PPP: couldn't register device %s (%d)\n",
dev->name, ret);
+ cardmap_set(&all_ppp_units, unit, NULL))
goto err_unlock;
}
atomic_inc(&ppp_unit_count);
- cardmap_set(&all_ppp_units, unit, ppp);
up(&all_ppp_sem);
*retp = 0;
return ppp;
@@ -2542,6 +2545,8 @@ static void cardmap_set(struct cardmap *
do {
/* need a new top level */
struct cardmap *np = kmalloc(sizeof(*np), GFP_KERNEL);
+ if (np == 0)
+ return -ENOMEM;
memset(np, 0, sizeof(*np));
np->ptr[0] = p;
if (p != NULL) {
@@ -2557,6 +2562,8 @@ static void cardmap_set(struct cardmap *
i = (nr >> p->shift) & CARDMAP_MASK;
if (p->ptr[i] == NULL) {
struct cardmap *np = kmalloc(sizeof(*np), GFP_KERNEL);
+ if (np == 0)
+ return -ENOMEM;
memset(np, 0, sizeof(*np));
np->shift = p->shift - CARDMAP_ORDER;
np->parent = p;
--=_courier-31981-1052739452-0001-2--