aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/mtd
diff options
context:
space:
mode:
authorAnton Prins <anton.prins@nl.bosch.com>2012-11-27 10:38:16 -0500
committerArtem Bityutskiy <artem.bityutskiy@linux.intel.com>2012-12-10 08:31:36 -0500
commite58a66d84bceba314b03e37ec0764b9b1b9227d0 (patch)
tree03d076c652b3f2701f2f2e54181903201b847df0 /drivers/mtd
parent6c810f90140a3274181c4093d5dd4c88c6fff0b4 (diff)
mtd: physmap_of: error checking to prevent a NULL pointer dereference
This patch solves a NULL pointer dereference, this may occur if the tuple is not mappable (jumps to continue in the for-loop). Out of the loop possible results are: - info->list_size == 0 if no of the tuples is mappable - info->list_size == 1 - info->list_size > 1 If no one of the supplied tuples is mappable (info->list_size == 0) and info->cmtd will not be set. But it is used in mtd_device_parse_register, OOPS! actually it should generate an error in this case! Signed-off-by: Anton Prins <anton.prins@nl.bosch.com> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Diffstat (limited to 'drivers/mtd')
-rw-r--r--drivers/mtd/maps/physmap_of.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
index cde8bf94338e..37cdc201652f 100644
--- a/drivers/mtd/maps/physmap_of.c
+++ b/drivers/mtd/maps/physmap_of.c
@@ -285,6 +285,7 @@ static int of_flash_probe(struct platform_device *dev)
285 } 285 }
286 286
287 err = 0; 287 err = 0;
288 info->cmtd = NULL;
288 if (info->list_size == 1) { 289 if (info->list_size == 1) {
289 info->cmtd = info->list[0].mtd; 290 info->cmtd = info->list[0].mtd;
290 } else if (info->list_size > 1) { 291 } else if (info->list_size > 1) {
@@ -293,9 +294,10 @@ static int of_flash_probe(struct platform_device *dev)
293 */ 294 */
294 info->cmtd = mtd_concat_create(mtd_list, info->list_size, 295 info->cmtd = mtd_concat_create(mtd_list, info->list_size,
295 dev_name(&dev->dev)); 296 dev_name(&dev->dev));
296 if (info->cmtd == NULL)
297 err = -ENXIO;
298 } 297 }
298 if (info->cmtd == NULL)
299 err = -ENXIO;
300
299 if (err) 301 if (err)
300 goto err_out; 302 goto err_out;
301 303