svn commit: r322270 - head/sys/dev/mly

[John Baldwin]

Author: jhb
Date: Tue Aug  8 17:49:57 2017
New Revision: 322270
URL: https://svnweb.freebsd.org/changeset/base/322270

Log:
  Fix a NULL pointer dereference in mly_user_command().
  
  If mly_user_command fails to allocate a command slot it jumps to an 'out'
  label used for error handling.  The error handling code checks for a data
  buffer in 'mc->mc_data' to free before checking if 'mc' is NULL.  Fix by
  just returning directly if we fail to allocate a command and only using
  the 'out' label for subsequent errors when there is actual cleanup to
  perform.
  
  PR:		217747
  Reported by:	PVS-Studio
  Reviewed by:	emaste
  MFC after:	1 week

Modified:
  head/sys/dev/mly/mly.c

Modified: head/sys/dev/mly/mly.c
==============================================================================
--- head/sys/dev/mly/mly.c	Tue Aug  8 17:26:19 2017	(r322269)
+++ head/sys/dev/mly/mly.c	Tue Aug  8 17:49:57 2017	(r322270)
@@ -2892,8 +2892,7 @@ mly_user_command(struct mly_softc *sc, struct mly_user
     MLY_LOCK(sc);
     if (mly_alloc_command(sc, &mc)) {
 	MLY_UNLOCK(sc);
-	error = ENOMEM;
-	goto out;		/* XXX Linux version will wait for a command */
+	return (ENOMEM);	/* XXX Linux version will wait for a command */
     }
     MLY_UNLOCK(sc);
 
@@ -2952,11 +2951,9 @@ mly_user_command(struct mly_softc *sc, struct mly_user
  out:
     if (mc->mc_data != NULL)
 	free(mc->mc_data, M_DEVBUF);
-    if (mc != NULL) {
-	MLY_LOCK(sc);
-	mly_release_command(mc);
-	MLY_UNLOCK(sc);
-    }
+    MLY_LOCK(sc);
+    mly_release_command(mc);
+    MLY_UNLOCK(sc);
     return(error);
 }