xen/blkback: potential null dereference in error handling
authorDan Carpenter <error27@gmail.com>
Fri, 27 May 2011 06:27:16 +0000 (09:27 +0300)
committerKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Wed, 1 Jun 2011 13:28:21 +0000 (09:28 -0400)
blkbk->pending_pages can be NULL here so I added a check for it.

Signed-off-by: Dan Carpenter <error27@gmail.com>
[v1: Redid the loop a bit]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
drivers/block/xen-blkback/blkback.c

index c73910cc28c919bfdcdc6f1972af1f1f95822138..5cf2993a8338c9e325fb6126d5a6ec3ca371f6e3 100644 (file)
@@ -809,11 +809,13 @@ static int __init xen_blkif_init(void)
  failed_init:
        kfree(blkbk->pending_reqs);
        kfree(blkbk->pending_grant_handles);
-       for (i = 0; i < mmap_pages; i++) {
-               if (blkbk->pending_pages[i])
-                       __free_page(blkbk->pending_pages[i]);
+       if (blkbk->pending_pages) {
+               for (i = 0; i < mmap_pages; i++) {
+                       if (blkbk->pending_pages[i])
+                               __free_page(blkbk->pending_pages[i]);
+               }
+               kfree(blkbk->pending_pages);
        }
-       kfree(blkbk->pending_pages);
        kfree(blkbk);
        blkbk = NULL;
        return rc;