summaryrefslogtreecommitdiff
path: root/drivers/mtd
diff options
context:
space:
mode:
authorAtsushi Nemoto <anemo@mba.ocn.ne.jp>2009-03-10 22:55:55 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2009-03-11 01:55:11 +0300
commitd58ab5cf09679d8cb4824e22cae900c0eab5ab31 (patch)
tree090e82a516fe8db760a1b7514ed072bb458c1e2f /drivers/mtd
parent9c1e8a4ebcc04226cb6f3a1bf1d72f4cafd6b089 (diff)
downloadlinux-d58ab5cf09679d8cb4824e22cae900c0eab5ab31.tar.xz
mtd: physmap: fix NULL pointer dereference in error path
commit e480814f138cd5d78a8efe397756ba6b6518fdb6 ("[MTD] [MAPS] physmap: fix wrong free and del_mtd_{partition,device}") introduces a NULL pointer dereference in physmap_flash_remove when called from the error path in physmap_flash_probe (if map_probe failed). Call del_mtd_{partition,device} only if info->cmtd was not NULL. Reported-by: pHilipp Zabel <philipp.zabel@gmail.com> Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp> Cc: David Woodhouse <dwmw2@infradead.org> Cc: "Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/mtd')
-rw-r--r--drivers/mtd/maps/physmap.c19
1 files changed, 11 insertions, 8 deletions
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 4b122e7ab4b3..229718222db7 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -46,16 +46,19 @@ static int physmap_flash_remove(struct platform_device *dev)
physmap_data = dev->dev.platform_data;
+ if (info->cmtd) {
#ifdef CONFIG_MTD_PARTITIONS
- if (info->nr_parts) {
- del_mtd_partitions(info->cmtd);
- kfree(info->parts);
- } else if (physmap_data->nr_parts)
- del_mtd_partitions(info->cmtd);
- else
- del_mtd_device(info->cmtd);
+ if (info->nr_parts || physmap_data->nr_parts)
+ del_mtd_partitions(info->cmtd);
+ else
+ del_mtd_device(info->cmtd);
#else
- del_mtd_device(info->cmtd);
+ del_mtd_device(info->cmtd);
+#endif
+ }
+#ifdef CONFIG_MTD_PARTITIONS
+ if (info->nr_parts)
+ kfree(info->parts);
#endif
#ifdef CONFIG_MTD_CONCAT