fec_init() will only allocate fec->base_ptr if it is non-NULL. But the cleanup routine on error will free the pointer without setting it to NULL. This means that a later call to fec_init() would result in using an invalid pointer.

The following patch to fix this is against u-boot-2009.11-rc2.

Signed-off-by: John Ogness john.ogness@linutronix.de --- drivers/net/fec_mxc.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/fec_mxc.c +++ b/drivers/net/fec_mxc.c @@ -450,6 +450,7 @@ static int fec_init(struct eth_device *d */ if (fec_rbd_init(fec, FEC_RBD_NUM, FEC_MAX_PKT_SIZE) < 0) { free(fec->base_ptr); + fec->base_ptr = NULL; return -ENOMEM; } fec_tbd_init(fec);