Patchwork [v2] mtd/docg3: dereferencing an ERR_PTR() in docg3_probe()

login
register
mail settings
Submitter Dan Carpenter
Date Nov. 28, 2011, 1:53 p.m.
Message ID <20111128134947.GK21128@mwanda>
Download mbox | patch
Permalink /patch/127993/
State Accepted
Commit b49e345e61a2e0c4decbe9b1bd670ed5599fac6e
Headers show

Comments

Dan Carpenter - Nov. 28, 2011, 1:53 p.m.
If doc_probe_device() returned an ERR_PTR, then we accidentally saved
that to docg3_floors[floor] = mtd; which gets derefenced in the error
handling when we call doc_release_device().

I've reworked the error handling to take care of that and hopefully
make it a little simpler.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: Version 1 conflicted with another patch in stream.
Robert Jarzmik - Nov. 29, 2011, 10 p.m.
Dan Carpenter <dan.carpenter@oracle.com> writes:

> If doc_probe_device() returned an ERR_PTR, then we accidentally saved
> that to docg3_floors[floor] = mtd; which gets derefenced in the error
> handling when we call doc_release_device().
>
> I've reworked the error handling to take care of that and hopefully
> make it a little simpler.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: Version 1 conflicted with another patch in stream.
Ok, applied and tested locally (even if that branch of code obviously is not
triggered in my case), and everything should work even better with it.

Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>

Cheers.

--
Robert
Artem Bityutskiy - Dec. 1, 2011, 8:02 a.m.
On Mon, 2011-11-28 at 16:53 +0300, Dan Carpenter wrote:
> If doc_probe_device() returned an ERR_PTR, then we accidentally saved
> that to docg3_floors[floor] = mtd; which gets derefenced in the error
> handling when we call doc_release_device().
> 
> I've reworked the error handling to take care of that and hopefully
> make it a little simpler.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Pushed to l2-mtd-2.6.git, thanks!

Artem.

Patch

diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index d7df311..f7490a014 100644
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -2027,21 +2027,24 @@  static int __init docg3_probe(struct platform_device *pdev)
 	if (!docg3_bch)
 		goto nomem2;
 
-	ret = 0;
 	for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
 		mtd = doc_probe_device(base, floor, dev);
-		if (floor == 0 && !mtd)
-			goto notfound;
-		if (!IS_ERR_OR_NULL(mtd))
-			ret = mtd_device_parse_register(mtd, part_probes,
-							NULL, NULL, 0);
-		else
+		if (IS_ERR(mtd)) {
 			ret = PTR_ERR(mtd);
+			goto err_probe;
+		}
+		if (!mtd) {
+			if (floor == 0)
+				goto notfound;
+			else
+				continue;
+		}
 		docg3_floors[floor] = mtd;
+		ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL,
+						0);
 		if (ret)
 			goto err_probe;
-		if (mtd)
-			found++;
+		found++;
 	}
 
 	ret = doc_register_sysfs(pdev, docg3_floors);