diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2011-11-28 16:53:13 +0300 |
|---|---|---|
| committer | David Woodhouse <David.Woodhouse@intel.com> | 2012-01-09 18:07:32 +0000 |
| commit | b49e345e61a2e0c4decbe9b1bd670ed5599fac6e (patch) | |
| tree | e125dca29028b59322fe3b7bb096b4191bff0791 /drivers/mtd | |
| parent | 5d3667eee40a88f79f7f826f0b4c3c9647d7ea7a (diff) | |
mtd: docg3: dereferencing an ERR_PTR() in docg3_probe()
If doc_probe_device() returned an ERR_PTR, then we accidentally saved
that to docg3_floors[floor] = mtd; which gets derefenced in the error
handling when we call doc_release_device().
I've reworked the error handling to take care of that and hopefully
make it a little simpler.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/devices/docg3.c | 21 |
1 files changed, 12 insertions, 9 deletions
diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c index d7df3114aa17..f7490a014e78 100644 --- a/drivers/mtd/devices/docg3.c +++ b/drivers/mtd/devices/docg3.c @@ -2027,21 +2027,24 @@ static int __init docg3_probe(struct platform_device *pdev) if (!docg3_bch) goto nomem2; - ret = 0; for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) { mtd = doc_probe_device(base, floor, dev); - if (floor == 0 && !mtd) - goto notfound; - if (!IS_ERR_OR_NULL(mtd)) - ret = mtd_device_parse_register(mtd, part_probes, - NULL, NULL, 0); - else + if (IS_ERR(mtd)) { ret = PTR_ERR(mtd); + goto err_probe; + } + if (!mtd) { + if (floor == 0) + goto notfound; + else + continue; + } docg3_floors[floor] = mtd; + ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL, + 0); if (ret) goto err_probe; - if (mtd) - found++; + found++; } ret = doc_register_sysfs(pdev, docg3_floors); |