[patch] [checker] 120 potential dereference to invalid pointers errors for linux 2.4.1

From: Andrew Morton (andrewm@uow.edu.au)
Date: Sat Mar 24 2001 - 12:45:06 EST


This gets us about 1/3 of the way through this one.

Affected files:

fs/proc/generic.c
arch/i386/kernel/irq.c
arch/i386/kernel/mtrr.c
drivers/acpi/dispatcher/dswload.c
drivers/atm/zatm.c
drivers/block/DAC960.c
drivers/block/ll_rw_blk.c
drivers/char/pc_keyb.c
drivers/char/rio/rio_linux.c
drivers/message/i2o/i2o_core.c

Four reports (drm and ip2main.c) were non-obvious and the
maintainers have been poked.

The ll_rw_blk.c change could be a little more elegant.
Really, we should propagate a failure of blk_init_queue()
all the way back to the caller. In this patch we simply
leave the device with a less-than-expected pool of requests
and just limp along. Seems to be better than crashing.

Patch is against -ac24.

--- linux-2.4.2-ac24/fs/proc/generic.c Sat Mar 24 14:28:22 2001
+++ ac/fs/proc/generic.c Sun Mar 25 02:16:59 2001
@@ -531,6 +531,8 @@
         proc_register(parent, ent);
         
 out:
+ if (ent == NULL)
+ printk(KERN_EMERG "create_proc_entry: failed to create entry for %s\n", name);
         return ent;
 }
 
--- linux-2.4.2-ac24/arch/i386/kernel/irq.c Sat Mar 24 14:28:02 2001
+++ ac/arch/i386/kernel/irq.c Sun Mar 25 02:15:00 2001
@@ -1155,10 +1155,12 @@
                 /* create /proc/irq/1234/smp_affinity */
                 entry = create_proc_entry("smp_affinity", 0600, irq_dir[irq]);
 
- entry->nlink = 1;
- entry->data = (void *)(long)irq;
- entry->read_proc = irq_affinity_read_proc;
- entry->write_proc = irq_affinity_write_proc;
+ if (entry) {
+ entry->nlink = 1;
+ entry->data = (void *)(long)irq;
+ entry->read_proc = irq_affinity_read_proc;
+ entry->write_proc = irq_affinity_write_proc;
+ }
 
                 smp_affinity_entry[irq] = entry;
         }
--- linux-2.4.2-ac24/arch/i386/kernel/mtrr.c Sat Mar 24 14:28:02 2001
+++ ac/arch/i386/kernel/mtrr.c Sun Mar 25 02:20:08 2001
@@ -1809,7 +1809,8 @@
     }
     devfs_set_file_size (devfs_handle, ascii_buf_bytes);
 # ifdef CONFIG_PROC_FS
- proc_root_mtrr->size = ascii_buf_bytes;
+ if (proc_root_mtrr)
+ proc_root_mtrr->size = ascii_buf_bytes;
 # endif /* CONFIG_PROC_FS */
 } /* End Function compute_ascii */
 
@@ -2118,8 +2119,10 @@
 
 #ifdef CONFIG_PROC_FS
     proc_root_mtrr = create_proc_entry ("mtrr", S_IWUSR | S_IRUGO, &proc_root);
- proc_root_mtrr->owner = THIS_MODULE;
- proc_root_mtrr->proc_fops = &mtrr_fops;
+ if (proc_root_mtrr) {
+ proc_root_mtrr->owner = THIS_MODULE;
+ proc_root_mtrr->proc_fops = &mtrr_fops;
+ }
 #endif
 #ifdef CONFIG_DEVFS_FS
     devfs_handle = devfs_register (NULL, "cpu/mtrr", DEVFS_FL_DEFAULT, 0, 0,
--- linux-2.4.2-ac24/drivers/acpi/dispatcher/dswload.c Tue Jan 23 08:23:42 2001
+++ ac/drivers/acpi/dispatcher/dswload.c Sun Mar 25 02:26:24 2001
@@ -455,6 +455,11 @@
                         arg = acpi_ps_get_arg (op, 2);
                 }
 
+ if (arg == NULL) {
+ status = AE_NOT_FOUND;
+ break;
+ }
+
                 /*
                  * Enter the Name_string into the namespace
                  */
--- linux-2.4.2-ac24/drivers/atm/zatm.c Wed Jul 19 07:55:01 2000
+++ ac/drivers/atm/zatm.c Sun Mar 25 02:37:13 2001
@@ -1826,9 +1826,13 @@
                         devs++;
                         zatm_dev = (struct zatm_dev *) kmalloc(sizeof(struct
                             zatm_dev),GFP_KERNEL);
- if (!zatm_dev) break;
+ if (!zatm_dev) {
+ printk(KERN_EMERG "zatm.c: memory shortage\n");
+ goto out;
+ }
                 }
         }
+out:
         return devs;
 }
 
--- linux-2.4.2-ac24/drivers/block/DAC960.c Sat Mar 24 14:28:03 2001
+++ ac/drivers/block/DAC960.c Sun Mar 25 02:52:27 2001
@@ -506,16 +506,20 @@
                                       void *DataPointer)
 {
   DAC960_Command_T *Command = DAC960_AllocateCommand(Controller);
- DAC960_V1_CommandMailbox_T *CommandMailbox = &Command->V1.CommandMailbox;
- DAC960_V1_CommandStatus_T CommandStatus;
- DAC960_V1_ClearCommand(Command);
- Command->CommandType = DAC960_ImmediateCommand;
- CommandMailbox->Type3.CommandOpcode = CommandOpcode;
- CommandMailbox->Type3.BusAddress = Virtual_to_Bus32(DataPointer);
- DAC960_ExecuteCommand(Command);
- CommandStatus = Command->V1.CommandStatus;
- DAC960_DeallocateCommand(Command);
- return (CommandStatus == DAC960_V1_NormalCompletion);
+ if (Command == NULL) {
+ return false;
+ } else {
+ DAC960_V1_CommandMailbox_T *CommandMailbox = &Command->V1.CommandMailbox;
+ DAC960_V1_CommandStatus_T CommandStatus;
+ DAC960_V1_ClearCommand(Command);
+ Command->CommandType = DAC960_ImmediateCommand;
+ CommandMailbox->Type3.CommandOpcode = CommandOpcode;
+ CommandMailbox->Type3.BusAddress = Virtual_to_Bus32(DataPointer);
+ DAC960_ExecuteCommand(Command);
+ CommandStatus = Command->V1.CommandStatus;
+ DAC960_DeallocateCommand(Command);
+ return (CommandStatus == DAC960_V1_NormalCompletion);
+ }
 }
 
 
@@ -532,18 +536,22 @@
                                        void *DataPointer)
 {
   DAC960_Command_T *Command = DAC960_AllocateCommand(Controller);
- DAC960_V1_CommandMailbox_T *CommandMailbox = &Command->V1.CommandMailbox;
- DAC960_V1_CommandStatus_T CommandStatus;
- DAC960_V1_ClearCommand(Command);
- Command->CommandType = DAC960_ImmediateCommand;
- CommandMailbox->Type3D.CommandOpcode = CommandOpcode;
- CommandMailbox->Type3D.Channel = Channel;
- CommandMailbox->Type3D.TargetID = TargetID;
- CommandMailbox->Type3D.BusAddress = Virtual_to_Bus32(DataPointer);
- DAC960_ExecuteCommand(Command);
- CommandStatus = Command->V1.CommandStatus;
- DAC960_DeallocateCommand(Command);
- return (CommandStatus == DAC960_V1_NormalCompletion);
+ if (Command == NULL) {
+ return false;
+ } else {
+ DAC960_V1_CommandMailbox_T *CommandMailbox = &Command->V1.CommandMailbox;
+ DAC960_V1_CommandStatus_T CommandStatus;
+ DAC960_V1_ClearCommand(Command);
+ Command->CommandType = DAC960_ImmediateCommand;
+ CommandMailbox->Type3D.CommandOpcode = CommandOpcode;
+ CommandMailbox->Type3D.Channel = Channel;
+ CommandMailbox->Type3D.TargetID = TargetID;
+ CommandMailbox->Type3D.BusAddress = Virtual_to_Bus32(DataPointer);
+ DAC960_ExecuteCommand(Command);
+ CommandStatus = Command->V1.CommandStatus;
+ DAC960_DeallocateCommand(Command);
+ return (CommandStatus == DAC960_V1_NormalCompletion);
+ }
 }
 
 
@@ -559,29 +567,33 @@
                                      unsigned int DataByteCount)
 {
   DAC960_Command_T *Command = DAC960_AllocateCommand(Controller);
- DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
- DAC960_V2_CommandStatus_T CommandStatus;
- DAC960_V2_ClearCommand(Command);
- Command->CommandType = DAC960_ImmediateCommand;
- CommandMailbox->Common.CommandOpcode = DAC960_V2_IOCTL;
- CommandMailbox->Common.CommandControlBits
+ if (Command == NULL) {
+ return false;
+ } else {
+ DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
+ DAC960_V2_CommandStatus_T CommandStatus;
+ DAC960_V2_ClearCommand(Command);
+ Command->CommandType = DAC960_ImmediateCommand;
+ CommandMailbox->Common.CommandOpcode = DAC960_V2_IOCTL;
+ CommandMailbox->Common.CommandControlBits
                         .DataTransferControllerToHost = true;
- CommandMailbox->Common.CommandControlBits
+ CommandMailbox->Common.CommandControlBits
                         .NoAutoRequestSense = true;
- CommandMailbox->Common.DataTransferSize = DataByteCount;
- CommandMailbox->Common.IOCTL_Opcode = IOCTL_Opcode;
- CommandMailbox->Common.DataTransferMemoryAddress
+ CommandMailbox->Common.DataTransferSize = DataByteCount;
+ CommandMailbox->Common.IOCTL_Opcode = IOCTL_Opcode;
+ CommandMailbox->Common.DataTransferMemoryAddress
                         .ScatterGatherSegments[0]
                         .SegmentDataPointer =
- Virtual_to_Bus64(DataPointer);
- CommandMailbox->Common.DataTransferMemoryAddress
+ Virtual_to_Bus64(DataPointer);
+ CommandMailbox->Common.DataTransferMemoryAddress
                         .ScatterGatherSegments[0]
                         .SegmentByteCount =
- CommandMailbox->Common.DataTransferSize;
- DAC960_ExecuteCommand(Command);
- CommandStatus = Command->V2.CommandStatus;
- DAC960_DeallocateCommand(Command);
- return (CommandStatus == DAC960_V2_NormalCompletion);
+ CommandMailbox->Common.DataTransferSize;
+ DAC960_ExecuteCommand(Command);
+ CommandStatus = Command->V2.CommandStatus;
+ DAC960_DeallocateCommand(Command);
+ return (CommandStatus == DAC960_V2_NormalCompletion);
+ }
 }
 
 
@@ -597,30 +609,34 @@
                                         unsigned int DataByteCount)
 {
   DAC960_Command_T *Command = DAC960_AllocateCommand(Controller);
- DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
- DAC960_V2_CommandStatus_T CommandStatus;
- DAC960_V2_ClearCommand(Command);
- Command->CommandType = DAC960_ImmediateCommand;
- CommandMailbox->ControllerInfo.CommandOpcode = DAC960_V2_IOCTL;
- CommandMailbox->ControllerInfo.CommandControlBits
+ if (Command == NULL) {
+ return false;
+ } else {
+ DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
+ DAC960_V2_CommandStatus_T CommandStatus;
+ DAC960_V2_ClearCommand(Command);
+ Command->CommandType = DAC960_ImmediateCommand;
+ CommandMailbox->ControllerInfo.CommandOpcode = DAC960_V2_IOCTL;
+ CommandMailbox->ControllerInfo.CommandControlBits
                                 .DataTransferControllerToHost = true;
- CommandMailbox->ControllerInfo.CommandControlBits
+ CommandMailbox->ControllerInfo.CommandControlBits
                                 .NoAutoRequestSense = true;
- CommandMailbox->ControllerInfo.DataTransferSize = DataByteCount;
- CommandMailbox->ControllerInfo.ControllerNumber = 0;
- CommandMailbox->ControllerInfo.IOCTL_Opcode = IOCTL_Opcode;
- CommandMailbox->ControllerInfo.DataTransferMemoryAddress
+ CommandMailbox->ControllerInfo.DataTransferSize = DataByteCount;
+ CommandMailbox->ControllerInfo.ControllerNumber = 0;
+ CommandMailbox->ControllerInfo.IOCTL_Opcode = IOCTL_Opcode;
+ CommandMailbox->ControllerInfo.DataTransferMemoryAddress
                                 .ScatterGatherSegments[0]
                                 .SegmentDataPointer =
- Virtual_to_Bus64(DataPointer);
- CommandMailbox->ControllerInfo.DataTransferMemoryAddress
+ Virtual_to_Bus64(DataPointer);
+ CommandMailbox->ControllerInfo.DataTransferMemoryAddress
                                 .ScatterGatherSegments[0]
                                 .SegmentByteCount =
- CommandMailbox->ControllerInfo.DataTransferSize;
- DAC960_ExecuteCommand(Command);
- CommandStatus = Command->V2.CommandStatus;
- DAC960_DeallocateCommand(Command);
- return (CommandStatus == DAC960_V2_NormalCompletion);
+ CommandMailbox->ControllerInfo.DataTransferSize;
+ DAC960_ExecuteCommand(Command);
+ CommandStatus = Command->V2.CommandStatus;
+ DAC960_DeallocateCommand(Command);
+ return (CommandStatus == DAC960_V2_NormalCompletion);
+ }
 }
 
 
@@ -639,31 +655,35 @@
                                            unsigned int DataByteCount)
 {
   DAC960_Command_T *Command = DAC960_AllocateCommand(Controller);
- DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
- DAC960_V2_CommandStatus_T CommandStatus;
- DAC960_V2_ClearCommand(Command);
- Command->CommandType = DAC960_ImmediateCommand;
- CommandMailbox->LogicalDeviceInfo.CommandOpcode = DAC960_V2_IOCTL;
- CommandMailbox->LogicalDeviceInfo.CommandControlBits
+ if (Command == NULL) {
+ return false;
+ } else {
+ DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
+ DAC960_V2_CommandStatus_T CommandStatus;
+ DAC960_V2_ClearCommand(Command);
+ Command->CommandType = DAC960_ImmediateCommand;
+ CommandMailbox->LogicalDeviceInfo.CommandOpcode = DAC960_V2_IOCTL;
+ CommandMailbox->LogicalDeviceInfo.CommandControlBits
                                    .DataTransferControllerToHost = true;
- CommandMailbox->LogicalDeviceInfo.CommandControlBits
+ CommandMailbox->LogicalDeviceInfo.CommandControlBits
                                    .NoAutoRequestSense = true;
- CommandMailbox->LogicalDeviceInfo.DataTransferSize = DataByteCount;
- CommandMailbox->LogicalDeviceInfo.LogicalDevice.LogicalDeviceNumber =
- LogicalDeviceNumber;
- CommandMailbox->LogicalDeviceInfo.IOCTL_Opcode = IOCTL_Opcode;
- CommandMailbox->LogicalDeviceInfo.DataTransferMemoryAddress
+ CommandMailbox->LogicalDeviceInfo.DataTransferSize = DataByteCount;
+ CommandMailbox->LogicalDeviceInfo.LogicalDevice.LogicalDeviceNumber =
+ LogicalDeviceNumber;
+ CommandMailbox->LogicalDeviceInfo.IOCTL_Opcode = IOCTL_Opcode;
+ CommandMailbox->LogicalDeviceInfo.DataTransferMemoryAddress
                                    .ScatterGatherSegments[0]
                                    .SegmentDataPointer =
- Virtual_to_Bus64(DataPointer);
- CommandMailbox->LogicalDeviceInfo.DataTransferMemoryAddress
+ Virtual_to_Bus64(DataPointer);
+ CommandMailbox->LogicalDeviceInfo.DataTransferMemoryAddress
                                    .ScatterGatherSegments[0]
                                    .SegmentByteCount =
- CommandMailbox->LogicalDeviceInfo.DataTransferSize;
- DAC960_ExecuteCommand(Command);
- CommandStatus = Command->V2.CommandStatus;
- DAC960_DeallocateCommand(Command);
- return (CommandStatus == DAC960_V2_NormalCompletion);
+ CommandMailbox->LogicalDeviceInfo.DataTransferSize;
+ DAC960_ExecuteCommand(Command);
+ CommandStatus = Command->V2.CommandStatus;
+ DAC960_DeallocateCommand(Command);
+ return (CommandStatus == DAC960_V2_NormalCompletion);
+ }
 }
 
 
@@ -683,32 +703,36 @@
                                             unsigned int DataByteCount)
 {
   DAC960_Command_T *Command = DAC960_AllocateCommand(Controller);
- DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
- DAC960_V2_CommandStatus_T CommandStatus;
- DAC960_V2_ClearCommand(Command);
- Command->CommandType = DAC960_ImmediateCommand;
- CommandMailbox->PhysicalDeviceInfo.CommandOpcode = DAC960_V2_IOCTL;
- CommandMailbox->PhysicalDeviceInfo.CommandControlBits
+ if (Command == NULL) {
+ return false;
+ } else {
+ DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
+ DAC960_V2_CommandStatus_T CommandStatus;
+ DAC960_V2_ClearCommand(Command);
+ Command->CommandType = DAC960_ImmediateCommand;
+ CommandMailbox->PhysicalDeviceInfo.CommandOpcode = DAC960_V2_IOCTL;
+ CommandMailbox->PhysicalDeviceInfo.CommandControlBits
                                     .DataTransferControllerToHost = true;
- CommandMailbox->PhysicalDeviceInfo.CommandControlBits
+ CommandMailbox->PhysicalDeviceInfo.CommandControlBits
                                     .NoAutoRequestSense = true;
- CommandMailbox->PhysicalDeviceInfo.DataTransferSize = DataByteCount;
- CommandMailbox->PhysicalDeviceInfo.PhysicalDevice.LogicalUnit = LogicalUnit;
- CommandMailbox->PhysicalDeviceInfo.PhysicalDevice.TargetID = TargetID;
- CommandMailbox->PhysicalDeviceInfo.PhysicalDevice.Channel = Channel;
- CommandMailbox->PhysicalDeviceInfo.IOCTL_Opcode = IOCTL_Opcode;
- CommandMailbox->PhysicalDeviceInfo.DataTransferMemoryAddress
+ CommandMailbox->PhysicalDeviceInfo.DataTransferSize = DataByteCount;
+ CommandMailbox->PhysicalDeviceInfo.PhysicalDevice.LogicalUnit = LogicalUnit;
+ CommandMailbox->PhysicalDeviceInfo.PhysicalDevice.TargetID = TargetID;
+ CommandMailbox->PhysicalDeviceInfo.PhysicalDevice.Channel = Channel;
+ CommandMailbox->PhysicalDeviceInfo.IOCTL_Opcode = IOCTL_Opcode;
+ CommandMailbox->PhysicalDeviceInfo.DataTransferMemoryAddress
                                     .ScatterGatherSegments[0]
                                     .SegmentDataPointer =
- Virtual_to_Bus64(DataPointer);
- CommandMailbox->PhysicalDeviceInfo.DataTransferMemoryAddress
+ Virtual_to_Bus64(DataPointer);
+ CommandMailbox->PhysicalDeviceInfo.DataTransferMemoryAddress
                                     .ScatterGatherSegments[0]
                                     .SegmentByteCount =
- CommandMailbox->PhysicalDeviceInfo.DataTransferSize;
- DAC960_ExecuteCommand(Command);
- CommandStatus = Command->V2.CommandStatus;
- DAC960_DeallocateCommand(Command);
- return (CommandStatus == DAC960_V2_NormalCompletion);
+ CommandMailbox->PhysicalDeviceInfo.DataTransferSize;
+ DAC960_ExecuteCommand(Command);
+ CommandStatus = Command->V2.CommandStatus;
+ DAC960_DeallocateCommand(Command);
+ return (CommandStatus == DAC960_V2_NormalCompletion);
+ }
 }
 
 
@@ -724,21 +748,25 @@
                                            OperationDevice)
 {
   DAC960_Command_T *Command = DAC960_AllocateCommand(Controller);
- DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
- DAC960_V2_CommandStatus_T CommandStatus;
- DAC960_V2_ClearCommand(Command);
- Command->CommandType = DAC960_ImmediateCommand;
- CommandMailbox->DeviceOperation.CommandOpcode = DAC960_V2_IOCTL;
- CommandMailbox->DeviceOperation.CommandControlBits
+ if (Command == NULL) {
+ return false;
+ } else {
+ DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
+ DAC960_V2_CommandStatus_T CommandStatus;
+ DAC960_V2_ClearCommand(Command);
+ Command->CommandType = DAC960_ImmediateCommand;
+ CommandMailbox->DeviceOperation.CommandOpcode = DAC960_V2_IOCTL;
+ CommandMailbox->DeviceOperation.CommandControlBits
                                  .DataTransferControllerToHost = true;
- CommandMailbox->DeviceOperation.CommandControlBits
+ CommandMailbox->DeviceOperation.CommandControlBits
                                      .NoAutoRequestSense = true;
- CommandMailbox->DeviceOperation.IOCTL_Opcode = IOCTL_Opcode;
- CommandMailbox->DeviceOperation.OperationDevice = OperationDevice;
- DAC960_ExecuteCommand(Command);
- CommandStatus = Command->V2.CommandStatus;
- DAC960_DeallocateCommand(Command);
- return (CommandStatus == DAC960_V2_NormalCompletion);
+ CommandMailbox->DeviceOperation.IOCTL_Opcode = IOCTL_Opcode;
+ CommandMailbox->DeviceOperation.OperationDevice = OperationDevice;
+ DAC960_ExecuteCommand(Command);
+ CommandStatus = Command->V2.CommandStatus;
+ DAC960_DeallocateCommand(Command);
+ return (CommandStatus == DAC960_V2_NormalCompletion);
+ }
 }
 
 
@@ -1423,20 +1451,27 @@
         kmalloc(sizeof(DAC960_V2_PhysicalDeviceInfo_T), GFP_ATOMIC);
       if (PhysicalDeviceInfo == NULL)
         return DAC960_Failure(Controller, "PHYSICAL DEVICE ALLOCATION");
+ InquiryUnitSerialNumber = (DAC960_SCSI_Inquiry_UnitSerialNumber_T *)
+ kmalloc(sizeof(DAC960_SCSI_Inquiry_UnitSerialNumber_T), GFP_ATOMIC);
+ if (InquiryUnitSerialNumber == NULL) {
+ kfree(PhysicalDeviceInfo);
+ return DAC960_Failure(Controller, "SERIAL NUMBER ALLOCATION");
+ }
+ Command = DAC960_AllocateCommand(Controller);
+ if (Command == NULL) {
+ kfree(PhysicalDeviceInfo);
+ kfree(InquiryUnitSerialNumber);
+ return DAC960_Failure(Controller, "COMMAND ALLOCATION");
+ }
       Controller->V2.PhysicalDeviceInformation[PhysicalDeviceIndex] =
         PhysicalDeviceInfo;
       memcpy(PhysicalDeviceInfo, NewPhysicalDeviceInfo,
              sizeof(DAC960_V2_PhysicalDeviceInfo_T));
- InquiryUnitSerialNumber = (DAC960_SCSI_Inquiry_UnitSerialNumber_T *)
- kmalloc(sizeof(DAC960_SCSI_Inquiry_UnitSerialNumber_T), GFP_ATOMIC);
- if (InquiryUnitSerialNumber == NULL)
- return DAC960_Failure(Controller, "SERIAL NUMBER ALLOCATION");
       Controller->V2.InquiryUnitSerialNumber[PhysicalDeviceIndex] =
         InquiryUnitSerialNumber;
       memset(InquiryUnitSerialNumber, 0,
              sizeof(DAC960_SCSI_Inquiry_UnitSerialNumber_T));
       InquiryUnitSerialNumber->PeripheralDeviceType = 0x1F;
- Command = DAC960_AllocateCommand(Controller);
       CommandMailbox = &Command->V2.CommandMailbox;
       DAC960_V2_ClearCommand(Command);
       Command->CommandType = DAC960_ImmediateCommand;
--- linux-2.4.2-ac24/drivers/block/ll_rw_blk.c Sat Mar 24 14:28:03 2001
+++ ac/drivers/block/ll_rw_blk.c Sun Mar 25 03:22:36 2001
@@ -395,6 +395,11 @@
          */
         for (i = 0; i < queue_nr_requests; i++) {
                 rq = kmem_cache_alloc(request_cachep, SLAB_KERNEL);
+ if (rq == NULL) {
+ /* We'll get a `leaked requests' message from blk_cleanup_queue */
+ printk(KERN_EMERG "blk_init_free_list: error allocating requests\n");
+ break;
+ }
                 memset(rq, 0, sizeof(struct request));
                 rq->rq_status = RQ_INACTIVE;
                 list_add(&rq->table, &q->request_freelist[i & 1]);
--- linux-2.4.2-ac24/drivers/char/pc_keyb.c Sat Mar 24 14:28:04 2001
+++ ac/drivers/char/pc_keyb.c Sun Mar 25 03:16:28 2001
@@ -1016,6 +1016,8 @@
 
         misc_register(&psaux_mouse);
         queue = (struct aux_queue *) kmalloc(sizeof(*queue), GFP_KERNEL);
+ if (queue == NULL)
+ panic("psaux_init(): out of memory");
         memset(queue, 0, sizeof(*queue));
         queue->head = queue->tail = 0;
         init_waitqueue_head(&queue->proc_list);
--- linux-2.4.2-ac24/drivers/char/rio/rio_linux.c Sun Feb 25 17:37:03 2001
+++ ac/drivers/char/rio/rio_linux.c Sun Mar 25 03:17:43 2001
@@ -1031,8 +1031,10 @@
  free2:kfree (p->RIOHosts);
  free1:kfree (p);
  free0:
- rio_dprintk (RIO_DEBUG_INIT, "Not enough memory! %p %p %p %p %p\n",
- p, p->RIOHosts, p->RIOPortp, rio_termios, rio_termios);
+ if (p) {
+ rio_dprintk (RIO_DEBUG_INIT, "Not enough memory! %p %p %p %p %p\n",
+ p, p->RIOHosts, p->RIOPortp, rio_termios, rio_termios);
+ }
   return -ENOMEM;
 }
 
--- linux-2.4.2-ac24/drivers/message/i2o/i2o_core.c Sat Mar 24 14:28:08 2001
+++ ac/drivers/message/i2o/i2o_core.c Sun Mar 25 03:20:16 2001
@@ -933,6 +933,10 @@
                                         kmalloc(sizeof(struct i2o_device), GFP_KERNEL);
                                 int i;
 
+ if (d == NULL) {
+ printk(KERN_EMERG "i2oevtd: out of memory\n");
+ break;
+ }
                                 memcpy(&d->lct_data, &msg[5], sizeof(i2o_lct_entry));
         
                                 d->next = NULL;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sat Mar 31 2001 - 21:00:10 EST