iwlwifi: fix freeing uninitialized pointer

If on iwl_dump_nic_event_log() error occurs before that function
initialize buf, we process uninitiated pointer in
iwl_dbgfs_log_event_read() and can hit "BUG at mm/slub.c:3409"

Resolves:
https://bugzilla.redhat.com/show_bug.cgi?id=951241

Cc: stable@vger.kernel.org
Reported-by: ian.odette@eprize.com
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index 7b8178be119f4d0a110a2beaae3a91165df45bf1..cb6dd5813fbc382e21533e22b071321de31038ca 100644 (file)
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -2237,15 +2237,15 @@ static ssize_t iwl_dbgfs_log_event_read(struct file *file,
                                         size_t count, loff_t *ppos)
 {
        struct iwl_priv *priv = file->private_data;
-       char *buf;
-       int pos = 0;
-       ssize_t ret = -ENOMEM;
+       char *buf = NULL;
+       ssize_t ret;
 
-       ret = pos = iwl_dump_nic_event_log(priv, true, &buf, true);
-       if (buf) {
-               ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-               kfree(buf);
-       }
+       ret = iwl_dump_nic_event_log(priv, true, &buf, true);
+       if (ret < 0)
+               goto err;
+       ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
+err:
+       kfree(buf);
        return ret;
 }