svn commit: r323826 - in stable: 10/sys/dev/mly 11/sys/dev/mly

[John Baldwin]

Author: jhb
Date: Wed Sep 20 20:48:21 2017
New Revision: 323826
URL: https://svnweb.freebsd.org/changeset/base/323826

Log:
  MFC 322270: Fix a NULL pointer dereference in mly_user_command().
  
  If mly_user_command fails to allocate a command slot it jumps to an 'out'
  label used for error handling.  The error handling code checks for a data
  buffer in 'mc->mc_data' to free before checking if 'mc' is NULL.  Fix by
  just returning directly if we fail to allocate a command and only using
  the 'out' label for subsequent errors when there is actual cleanup to
  perform.
  
  PR:		217747
  Reported by:	PVS-Studio

Modified:
  stable/11/sys/dev/mly/mly.c
Directory Properties:
  stable/11/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/10/sys/dev/mly/mly.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/11/sys/dev/mly/mly.c
==============================================================================
--- stable/11/sys/dev/mly/mly.c	Wed Sep 20 20:40:49 2017	(r323825)
+++ stable/11/sys/dev/mly/mly.c	Wed Sep 20 20:48:21 2017	(r323826)
@@ -2892,8 +2892,7 @@ mly_user_command(struct mly_softc *sc, struct mly_user
     MLY_LOCK(sc);
     if (mly_alloc_command(sc, &mc)) {
 	MLY_UNLOCK(sc);
-	error = ENOMEM;
-	goto out;		/* XXX Linux version will wait for a command */
+	return (ENOMEM);	/* XXX Linux version will wait for a command */
     }
     MLY_UNLOCK(sc);
 
@@ -2952,11 +2951,9 @@ mly_user_command(struct mly_softc *sc, struct mly_user
  out:
     if (mc->mc_data != NULL)
 	free(mc->mc_data, M_DEVBUF);
-    if (mc != NULL) {
-	MLY_LOCK(sc);
-	mly_release_command(mc);
-	MLY_UNLOCK(sc);
-    }
+    MLY_LOCK(sc);
+    mly_release_command(mc);
+    MLY_UNLOCK(sc);
     return(error);
 }