diff options
author | Anton Prins <anton.prins@nl.bosch.com> | 2012-11-27 10:38:16 -0500 |
---|---|---|
committer | Artem Bityutskiy <artem.bityutskiy@linux.intel.com> | 2012-12-10 08:31:36 -0500 |
commit | e58a66d84bceba314b03e37ec0764b9b1b9227d0 (patch) | |
tree | 03d076c652b3f2701f2f2e54181903201b847df0 /drivers/mtd | |
parent | 6c810f90140a3274181c4093d5dd4c88c6fff0b4 (diff) |
mtd: physmap_of: error checking to prevent a NULL pointer dereference
This patch solves a NULL pointer dereference, this may occur if the tuple
is not mappable (jumps to continue in the for-loop). Out of the loop
possible results are:
- info->list_size == 0 if no of the tuples is mappable
- info->list_size == 1
- info->list_size > 1
If no one of the supplied tuples is mappable (info->list_size == 0) and
info->cmtd will not be set. But it is used in mtd_device_parse_register, OOPS!
actually it should generate an error in this case!
Signed-off-by: Anton Prins <anton.prins@nl.bosch.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Diffstat (limited to 'drivers/mtd')
-rw-r--r-- | drivers/mtd/maps/physmap_of.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c index cde8bf94338e..37cdc201652f 100644 --- a/drivers/mtd/maps/physmap_of.c +++ b/drivers/mtd/maps/physmap_of.c | |||
@@ -285,6 +285,7 @@ static int of_flash_probe(struct platform_device *dev) | |||
285 | } | 285 | } |
286 | 286 | ||
287 | err = 0; | 287 | err = 0; |
288 | info->cmtd = NULL; | ||
288 | if (info->list_size == 1) { | 289 | if (info->list_size == 1) { |
289 | info->cmtd = info->list[0].mtd; | 290 | info->cmtd = info->list[0].mtd; |
290 | } else if (info->list_size > 1) { | 291 | } else if (info->list_size > 1) { |
@@ -293,9 +294,10 @@ static int of_flash_probe(struct platform_device *dev) | |||
293 | */ | 294 | */ |
294 | info->cmtd = mtd_concat_create(mtd_list, info->list_size, | 295 | info->cmtd = mtd_concat_create(mtd_list, info->list_size, |
295 | dev_name(&dev->dev)); | 296 | dev_name(&dev->dev)); |
296 | if (info->cmtd == NULL) | ||
297 | err = -ENXIO; | ||
298 | } | 297 | } |
298 | if (info->cmtd == NULL) | ||
299 | err = -ENXIO; | ||
300 | |||
299 | if (err) | 301 | if (err) |
300 | goto err_out; | 302 | goto err_out; |
301 | 303 | ||