MFC 322270: Fix a NULL pointer dereference in mly_user_command().

If mly_user_command fails to allocate a command slot it jumps to an 'out'
label used for error handling.  The error handling code checks for a data
buffer in 'mc->mc_data' to free before checking if 'mc' is NULL.  Fix by
just returning directly if we fail to allocate a command and only using
the 'out' label for subsequent errors when there is actual cleanup to
perform.

PR:		217747
Reported by:	PVS-Studio

1 files changed, 2 insertions, 4 deletions

diff --git a/sys/dev/mly/mly.c b/sys/dev/mly/mly.c
index b5244bb..980d197 100644
--- a/sys/dev/mly/mly.c
+++ b/sys/dev/mly/mly.c
@@ -2861,8 +2861,7 @@ mly_user_command(struct mly_softc *sc, struct mly_user_command *uc)
 
     /* allocate a command */
     if (mly_alloc_command(sc, &mc)) {
-	error = ENOMEM;
-	goto out;		/* XXX Linux version will wait for a command */
+	return (ENOMEM);	/* XXX Linux version will wait for a command */
     }
 
     /* handle data size/direction */
@@ -2918,8 +2917,7 @@ mly_user_command(struct mly_softc *sc, struct mly_user_command *uc)
  out:
     if (mc->mc_data != NULL)
 	free(mc->mc_data, M_DEVBUF);
-    if (mc != NULL)
-	mly_release_command(mc);
+    mly_release_command(mc);
     return(error);
 }