summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorShawn Lin <shawn.lin@rock-chips.com>2018-02-24 21:01:42 -0500
committerBjorn Helgaas <helgaas@kernel.org>2018-02-28 15:35:54 -0500
commit205adda79a408f4a2945f636e1c076f7db3b2045 (patch)
tree5839bc4242ed2c1bddfb646285d3955d795a01cb
parent7928b2cbe55b2a410a0f5c1f154610059c57b1b2 (diff)
PCI: cpqphp: Fix possible NULL pointer dereference
Check io_node for NULL before dereferencing it. Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
-rw-r--r--drivers/pci/hotplug/cpqphp_ctrl.c12
1 files changed, 5 insertions, 7 deletions
diff --git a/drivers/pci/hotplug/cpqphp_ctrl.c b/drivers/pci/hotplug/cpqphp_ctrl.c
index b1b6e45253b2..616df442520b 100644
--- a/drivers/pci/hotplug/cpqphp_ctrl.c
+++ b/drivers/pci/hotplug/cpqphp_ctrl.c
@@ -2812,18 +2812,16 @@ static int configure_new_function(struct controller *ctrl, struct pci_func *func
2812 2812
2813 dbg("CND: length = 0x%x\n", base); 2813 dbg("CND: length = 0x%x\n", base);
2814 io_node = get_io_resource(&(resources->io_head), base); 2814 io_node = get_io_resource(&(resources->io_head), base);
2815 if (!io_node)
2816 return -ENOMEM;
2815 dbg("Got io_node start = %8.8x, length = %8.8x next (%p)\n", 2817 dbg("Got io_node start = %8.8x, length = %8.8x next (%p)\n",
2816 io_node->base, io_node->length, io_node->next); 2818 io_node->base, io_node->length, io_node->next);
2817 dbg("func (%p) io_head (%p)\n", func, func->io_head); 2819 dbg("func (%p) io_head (%p)\n", func, func->io_head);
2818 2820
2819 /* allocate the resource to the board */ 2821 /* allocate the resource to the board */
2820 if (io_node) { 2822 base = io_node->base;
2821 base = io_node->base; 2823 io_node->next = func->io_head;
2822 2824 func->io_head = io_node;
2823 io_node->next = func->io_head;
2824 func->io_head = io_node;
2825 } else
2826 return -ENOMEM;
2827 } else if ((temp_register & 0x0BL) == 0x08) { 2825 } else if ((temp_register & 0x0BL) == 0x08) {
2828 /* Map prefetchable memory */ 2826 /* Map prefetchable memory */
2829 base = temp_register & 0xFFFFFFF0; 2827 base = temp_register & 0xFFFFFFF0;