diff mbox

i2c: busses/i2c-pxa.c: fix potential null pointer dereference error

Message ID 1360015899-13706-1-git-send-email-dinggnu@gmail.com
State Superseded
Headers show

Commit Message

Cong Ding Feb. 4, 2013, 10:11 p.m. UTC
If it goes to eclk through line 1107, the variable res would be NULL. It will
cause a null pointer dereference error if we call release_mem_region.

Signed-off-by: Cong Ding <dinggnu@gmail.com>
---
 drivers/i2c/busses/i2c-pxa.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Kyungmin Park Feb. 4, 2013, 11:47 p.m. UTC | #1
Hi,

On Tue, Feb 5, 2013 at 7:11 AM, Cong Ding <dinggnu@gmail.com> wrote:
> If it goes to eclk through line 1107, the variable res would be NULL. It will
> cause a null pointer dereference error if we call release_mem_region.
>
> Signed-off-by: Cong Ding <dinggnu@gmail.com>
> ---
>  drivers/i2c/busses/i2c-pxa.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
> index 1034d93..eadf1a4 100644
> --- a/drivers/i2c/busses/i2c-pxa.c
> +++ b/drivers/i2c/busses/i2c-pxa.c
> @@ -1211,7 +1211,8 @@ eremap:
>  eclk:
>         kfree(i2c);
>  emalloc:
> -       release_mem_region(res->start, resource_size(res));
> +       if (!res)
if (res)?
It's not match with description. and it seems wrong.

Thank you,
Kyungmin Park
> +               release_mem_region(res->start, resource_size(res));
>         return ret;
>  }
>
> --
> 1.7.9.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-i2c" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Cong Ding Feb. 5, 2013, 12:03 a.m. UTC | #2
On Tue, Feb 05, 2013 at 08:47:10AM +0900, Kyungmin Park wrote:
> Hi,
> 
> On Tue, Feb 5, 2013 at 7:11 AM, Cong Ding <dinggnu@gmail.com> wrote:
> > If it goes to eclk through line 1107, the variable res would be NULL. It will
> > cause a null pointer dereference error if we call release_mem_region.
> >
> > Signed-off-by: Cong Ding <dinggnu@gmail.com>
> > ---
> >  drivers/i2c/busses/i2c-pxa.c |    3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
> > index 1034d93..eadf1a4 100644
> > --- a/drivers/i2c/busses/i2c-pxa.c
> > +++ b/drivers/i2c/busses/i2c-pxa.c
> > @@ -1211,7 +1211,8 @@ eremap:
> >  eclk:
> >         kfree(i2c);
> >  emalloc:
> > -       release_mem_region(res->start, resource_size(res));
> > +       if (!res)
> if (res)?
> It's not match with description. and it seems wrong.
sorry my fault. will send version 2.
 - cong
> 
> Thank you,
> Kyungmin Park
> > +               release_mem_region(res->start, resource_size(res));
> >         return ret;
> >  }
> >
> > --
> > 1.7.9.5
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-i2c" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 1034d93..eadf1a4 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -1211,7 +1211,8 @@  eremap:
 eclk:
 	kfree(i2c);
 emalloc:
-	release_mem_region(res->start, resource_size(res));
+	if (!res)
+		release_mem_region(res->start, resource_size(res));
 	return ret;
 }