Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b49e345e authored by Dan Carpenter's avatar Dan Carpenter Committed by David Woodhouse
Browse files

mtd: docg3: dereferencing an ERR_PTR() in docg3_probe() 



If doc_probe_device() returned an ERR_PTR, then we accidentally saved
that to docg3_floors[floor] = mtd; which gets derefenced in the error
handling when we call doc_release_device().

I've reworked the error handling to take care of that and hopefully
make it a little simpler.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: default avatarArtem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent 5d3667ee

drivers/mtd/devices/docg3.c

+12 −9
Original line number Diff line number Diff line
@@ -2027,20 +2027,23 @@ static int __init docg3_probe(struct platform_device *pdev) 
	if (!docg3_bch)

		goto nomem2;



	ret = 0;

	for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {

		mtd = doc_probe_device(base, floor, dev);

		if (floor == 0 && !mtd)

		if (IS_ERR(mtd)) {

			ret = PTR_ERR(mtd);

			goto err_probe;

		}

		if (!mtd) {

			if (floor == 0)

				goto notfound;

		if (!IS_ERR_OR_NULL(mtd))

			ret = mtd_device_parse_register(mtd, part_probes,

							NULL, NULL, 0);

			else

			ret = PTR_ERR(mtd);

				continue;

		}

		docg3_floors[floor] = mtd;

		ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL,

						0);

		if (ret)

			goto err_probe;

		if (mtd)

		found++;

	}