| Message ID | 20111128134947.GK21128@mwanda |
|---|---|
| State | Accepted |
| Commit | b49e345e61a2e0c4decbe9b1bd670ed5599fac6e |
| Headers | show |
Dan Carpenter <dan.carpenter@oracle.com> writes: > If doc_probe_device() returned an ERR_PTR, then we accidentally saved > that to docg3_floors[floor] = mtd; which gets derefenced in the error > handling when we call doc_release_device(). > > I've reworked the error handling to take care of that and hopefully > make it a little simpler. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > v2: Version 1 conflicted with another patch in stream. Ok, applied and tested locally (even if that branch of code obviously is not triggered in my case), and everything should work even better with it. Acked-by: Robert Jarzmik <robert.jarzmik@free.fr> Cheers. -- Robert
On Mon, 2011-11-28 at 16:53 +0300, Dan Carpenter wrote: > If doc_probe_device() returned an ERR_PTR, then we accidentally saved > that to docg3_floors[floor] = mtd; which gets derefenced in the error > handling when we call doc_release_device(). > > I've reworked the error handling to take care of that and hopefully > make it a little simpler. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Pushed to l2-mtd-2.6.git, thanks! Artem.
diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c index d7df311..f7490a014 100644 --- a/drivers/mtd/devices/docg3.c +++ b/drivers/mtd/devices/docg3.c @@ -2027,21 +2027,24 @@ static int __init docg3_probe(struct platform_device *pdev) if (!docg3_bch) goto nomem2; - ret = 0; for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) { mtd = doc_probe_device(base, floor, dev); - if (floor == 0 && !mtd) - goto notfound; - if (!IS_ERR_OR_NULL(mtd)) - ret = mtd_device_parse_register(mtd, part_probes, - NULL, NULL, 0); - else + if (IS_ERR(mtd)) { ret = PTR_ERR(mtd); + goto err_probe; + } + if (!mtd) { + if (floor == 0) + goto notfound; + else + continue; + } docg3_floors[floor] = mtd; + ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL, + 0); if (ret) goto err_probe; - if (mtd) - found++; + found++; } ret = doc_register_sysfs(pdev, docg3_floors);
If doc_probe_device() returned an ERR_PTR, then we accidentally saved that to docg3_floors[floor] = mtd; which gets derefenced in the error handling when we call doc_release_device(). I've reworked the error handling to take care of that and hopefully make it a little simpler. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: Version 1 conflicted with another patch in stream.