lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mtd: docg3: dereferencing an ERR_PTR() in docg3_probe()

Browse Source 
If doc_probe_device() returned an ERR_PTR, then we accidentally saved
that to docg3_floors[floor] = mtd; which gets derefenced in the error
handling when we call doc_release_device().

I've reworked the error handling to take care of that and hopefully
make it a little simpler.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
This commit is contained in:
Dan Carpenter
2011-11-28 16:53:13 +03:00
committed by David Woodhouse
parent 5d3667eee4
commit b49e345e61
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/mtd/devices/docg3.c
View File

@@ -2027,21 +2027,24 @@ static int __init docg3_probe(struct platform_device *pdev)
if (!docg3_bch) if (!docg3_bch)
goto nomem2; goto nomem2;
ret = 0;
for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) { for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
mtd = doc_probe_device(base, floor, dev); mtd = doc_probe_device(base, floor, dev);
if (floor == 0 && !mtd) if (IS_ERR(mtd)) {
goto notfound;
if (!IS_ERR_OR_NULL(mtd))
ret = mtd_device_parse_register(mtd, part_probes,
NULL, NULL, 0);
else
ret = PTR_ERR(mtd); ret = PTR_ERR(mtd);
goto err_probe;
}
if (!mtd) {
if (floor == 0)
goto notfound;
else
continue;
}
docg3_floors[floor] = mtd; docg3_floors[floor] = mtd;
ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL,
0);
if (ret) if (ret)
goto err_probe; goto err_probe;
if (mtd) found++;
found++;
} }
ret = doc_register_sysfs(pdev, docg3_floors); ret = doc_register_sysfs(pdev, docg3_floors);