mmv/VUB300: null dereferences in error handling

In vub300_probe() from drivers/mmc/host/vub300.c we dereference vub300 when it's a NULL variable. Btw, let's remove the bogus initialization to NULL so that gcc will complain if the bug gets introduced again.

  2119          if (!command_out_urb) {
  2120                  retval = -ENOMEM;
  2121                  dev_err(&vub300->udev->dev,
                                 ^^^^^^^^^^^^
  2122                          "not enough memory for the command_out_urb\n");
  2123                  goto error0;
  2124          }
  2125          command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
  2126          if (!command_res_urb) {
  2127                  retval = -ENOMEM;
  2128                  dev_err(&vub300->udev->dev,
                                 ^^^^^^^^^^^^
  2129                          "not enough memory for the command_res_urb\n");
  2130                  goto error1;
  2131          }
  2132          /* this also allocates memory for our VUB300 mmc host device */
  2133          mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
  2134          if (!mmc) {
  2135                  retval = -ENOMEM;
  2136                  dev_err(&vub300->udev->dev,
                                 ^^^^^^^^^^^^
  2137                          "not enough memory for the mmc_host\n");
  2138                  goto error4;
  2139          }

regards,
dan carpenter

---

Thanks Dan -- I'll queue this fix up:

index cbb0330..d4455ff 100644
@@ -2096,7 +2096,7 @@ static struct mmc_host_ops vub300_mmc_ops = {
 static int vub300_probe(struct usb_interface *interface,
 			const struct usb_device_id *id)
 {				/* NOT irq */
-	struct vub300_mmc_host *vub300 = NULL;
+	struct vub300_mmc_host *vub300;
 	struct usb_host_interface *iface_desc;
 	struct usb_device *udev = usb_get_dev(interface_to_usbdev(interface));
 	int i;

@@ -2118,23 +2118,20 @@ static int vub300_probe(struct usb_interface *interface,
 	command_out_urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!command_out_urb) {
 		retval = -ENOMEM;
-		dev_err(&vub300->udev->dev,
-			"not enough memory for the command_out_urb\n");
+		dev_err(&udev->dev, "not enough memory for command_out_urb\n");
 		goto error0;
 	}
 	command_res_urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!command_res_urb) {
 		retval = -ENOMEM;
-		dev_err(&vub300->udev->dev,
-			"not enough memory for the command_res_urb\n");
+		dev_err(&udev->dev, "not enough memory for command_res_urb\n");
 		goto error1;
 	}
 	/* this also allocates memory for our VUB300 mmc host device */
 	mmc = mmc_alloc_host(sizeof(struct vub300_mmc_host), &udev->dev);
 	if (!mmc) {
 		retval = -ENOMEM;
-		dev_err(&vub300->udev->dev,
-			"not enough memory for the mmc_host\n");
+		dev_err(&udev->dev, "not enough memory for the mmc_host\n");
 		goto error4;
 	}
 	/* MMC core transfer sizes tunable parameters */

Chris Ball   <[email protected]>   <http://printf.net/>
One Laptop Per Child