diff options
author | Krzysztof Kozlowski <k.kozlowski@samsung.com> | 2014-03-12 16:50:44 +0100 |
---|---|---|
committer | Jiri Slaby <jslaby@suse.cz> | 2014-05-15 09:54:57 +0200 |
commit | d5688296e2f56884e43f7cee7c7b8d686e892f81 (patch) | |
tree | 260a3097c92964e2348fb39a0f8ea9aad446faa1 | |
parent | 9c2e8dca71c77b59d2602edb4a5b9b9c7a8caf6e (diff) |
mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail
commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream.
Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file")
tps65910_irq_init() sets 'tps65910->chip_irq' before calling
regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
memory allocation of regmap_irq_chip_data members then:
1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory
(because regmap_add_irq_chip() will free it on error)
This results in invalid memory access during driver remove because the
tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
-rw-r--r-- | drivers/mfd/tps65910.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c index d79277204835..de87eafbeb05 100644 --- a/drivers/mfd/tps65910.c +++ b/drivers/mfd/tps65910.c @@ -254,8 +254,10 @@ static int tps65910_irq_init(struct tps65910 *tps65910, int irq, ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq, IRQF_ONESHOT, pdata->irq_base, tps6591x_irqs_chip, &tps65910->irq_data); - if (ret < 0) + if (ret < 0) { dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret); + tps65910->chip_irq = 0; + } return ret; } |