Commit d58ab5cf authored Mar 10, 2009 by Atsushi Nemoto Committed by Linus Torvalds Mar 10, 2009

mtd: physmap: fix NULL pointer dereference in error path



commit e480814f ("[MTD] [MAPS] physmap:
fix wrong free and del_mtd_{partition,device}") introduces a NULL pointer
dereference in physmap_flash_remove when called from the error path in
physmap_flash_probe (if map_probe failed).

Call del_mtd_{partition,device} only if info->cmtd was not NULL.

Reported-by: pHilipp Zabel <philipp.zabel@gmail.com>
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 9c1e8a4e

drivers/mtd/maps/physmap.c

+11 −8

Original line number	Diff line number	Diff line
		@@ -46,17 +46,20 @@ static int physmap_flash_remove(struct platform_device *dev)

		physmap_data = dev->dev.platform_data;

		if (info->cmtd) {
		#ifdef CONFIG_MTD_PARTITIONS
		if (info->nr_parts) {
		del_mtd_partitions(info->cmtd);
		kfree(info->parts);
		} else if (physmap_data->nr_parts)
		if (info->nr_parts \|\| physmap_data->nr_parts)
		del_mtd_partitions(info->cmtd);
		else
		del_mtd_device(info->cmtd);
		#else
		del_mtd_device(info->cmtd);
		#endif
		}
		#ifdef CONFIG_MTD_PARTITIONS
		if (info->nr_parts)
		kfree(info->parts);
		#endif

		#ifdef CONFIG_MTD_CONCAT
		if (info->cmtd != info->mtd[0])