mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-21 16:29:59 +00:00
Code Issues Releases Wiki Activity

mtd: Fix kernel NULL pointer dereference in physmap.c

Browse source 
During the probe for physmap platform flash devices there are a
number error exit conditions that all do a goto err_out which
then calls physmap_flash_remove().  In that function one of the
cleanup steps is:

#ifdef CONFIG_MTD_CONCAT
	if (info->cmtd != info->mtd[0])
		mtd_concat_destroy(info->cmtd);
#endif

This test will succeed since info->cmtd == NULL and info->mtd[0] is
valid.

Fix this by exiting the remove function when info->cmtd == NULL.

Also, cleanup the #ifdef CONFIG_MTD_PARTITIONS stuff by using
mtd_has_partitions().

Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
This commit is contained in:
H Hartley Sweeten 2009-10-19 13:31:46 -04:00 committed by David Woodhouse
parent 2d098a7253
commit 4b56ffcace
1 changed files with 25 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
drivers/mtd/maps/physmap.c
View file

@ -44,22 +44,23 @@ static int physmap_flash_remove(struct platform_device *dev)
return 0; return 0;
platform_set_drvdata(dev, NULL); platform_set_drvdata(dev, NULL);
if (info->cmtd == NULL)
return 0;
physmap_data = dev->dev.platform_data; physmap_data = dev->dev.platform_data;
if (info->cmtd) { if (mtd_has_partitions()) {
#ifdef CONFIG_MTD_PARTITIONS if (info->nr_parts || physmap_data->nr_parts) {
if (info->nr_parts || physmap_data->nr_parts)
del_mtd_partitions(info->cmtd); del_mtd_partitions(info->cmtd);
else
del_mtd_device(info->cmtd);
#else
del_mtd_device(info->cmtd);
#endif
}
#ifdef CONFIG_MTD_PARTITIONS
if (info->nr_parts) if (info->nr_parts)
kfree(info->parts); kfree(info->parts);
#endif } else {
del_mtd_device(info->cmtd);
}
} else {
del_mtd_device(info->cmtd);
}
#ifdef CONFIG_MTD_CONCAT #ifdef CONFIG_MTD_CONCAT
if (info->cmtd != info->mtd[0]) if (info->cmtd != info->mtd[0])
@ -169,7 +170,7 @@ static int physmap_flash_probe(struct platform_device *dev)
if (err) if (err)
goto err_out; goto err_out;
#ifdef CONFIG_MTD_PARTITIONS if (mtd_has_partitions()) {
err = parse_mtd_partitions(info->cmtd, part_probe_types, err = parse_mtd_partitions(info->cmtd, part_probe_types,
&info->parts, 0); &info->parts, 0);
if (err > 0) { if (err > 0) {
@ -184,7 +185,7 @@ static int physmap_flash_probe(struct platform_device *dev)
physmap_data->nr_parts); physmap_data->nr_parts);
return 0; return 0;
} }
#endif }
add_mtd_device(info->cmtd); add_mtd_device(info->cmtd);
return 0; return 0;