RE: [PATCH -next] mei: fix krealloc() misuse in inmei_cl_irq_read_msg()

[Winkler, Tomas]

> From: Wei Yongjun <yongjun_wei@xxxxxxxxxxxxxxxxx>
> 
> If krealloc() returns NULL, it doesn't free the original. So any code of the form
> 'foo = krealloc(foo, ...);' is almost certainly a bug.
> 
> Introduced by commit fcb136e1ac5774909e0d85189f721b8dfa800e0f(mei: fix
> reading large reposnes)
> 
> Signed-off-by: Wei Yongjun <yongjun_wei@xxxxxxxxxxxxxxxxx>
Thanks, strange that my checkpatch didn't shout on that. 
I don't like the unrelated reuse of the  buffer variable but the code looks correct so ACK.

Thanks
Tomas

> ---
>  drivers/misc/mei/interrupt.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c index
> 37a8c35..089c516 100644
> --- a/drivers/misc/mei/interrupt.c
> +++ b/drivers/misc/mei/interrupt.c
> @@ -148,16 +148,16 @@ static int mei_cl_irq_read_msg(struct mei_device
> *dev,
>  			dev_dbg(&dev->pdev->dev, "message overflow.
> size %d len %d idx %ld\n",
>  				cb->response_buffer.size,
>  				mei_hdr->length, cb->buf_idx);
> -			cb->response_buffer.data =
> -					krealloc(cb->response_buffer.data,
> -					mei_hdr->length + cb->buf_idx,
> -					GFP_KERNEL);
> +			buffer = krealloc(cb->response_buffer.data,
> +					  mei_hdr->length + cb->buf_idx,
> +					  GFP_KERNEL);
> 
> -			if (!cb->response_buffer.data) {
> +			if (!buffer) {
>  				dev_err(&dev->pdev->dev, "allocation
> failed.\n");
>  				list_del(&cb->list);
>  				return -ENOMEM;
>  			}
> +			cb->response_buffer.data = buffer;
>  			cb->response_buffer.size =
>  				mei_hdr->length + cb->buf_idx;
>  		}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/