mtd: docg3: dereferencing an ERR_PTR() in docg3_probe()

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=b49e345e61a2e0c4decbe9b1bd670ed5599fac6e
Commit:     b49e345e61a2e0c4decbe9b1bd670ed5599fac6e
Parent:     5d3667eee40a88f79f7f826f0b4c3c9647d7ea7a
Author:     Dan Carpenter <dan.carpenter at oracle.com>
AuthorDate: Mon Nov 28 16:53:13 2011 +0300
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Mon Jan 9 18:07:32 2012 +0000

    mtd: docg3: dereferencing an ERR_PTR() in docg3_probe()
    
    If doc_probe_device() returned an ERR_PTR, then we accidentally saved
    that to docg3_floors[floor] = mtd; which gets derefenced in the error
    handling when we call doc_release_device().
    
    I've reworked the error handling to take care of that and hopefully
    make it a little simpler.
    
    Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
    Acked-by: Robert Jarzmik <robert.jarzmik at free.fr>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/devices/docg3.c |   21 ++++++++++++---------
 1 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index d7df311..f7490a014 100644
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -2027,21 +2027,24 @@ static int __init docg3_probe(struct platform_device *pdev)
 	if (!docg3_bch)
 		goto nomem2;
 
-	ret = 0;
 	for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
 		mtd = doc_probe_device(base, floor, dev);
-		if (floor == 0 && !mtd)
-			goto notfound;
-		if (!IS_ERR_OR_NULL(mtd))
-			ret = mtd_device_parse_register(mtd, part_probes,
-							NULL, NULL, 0);
-		else
+		if (IS_ERR(mtd)) {
 			ret = PTR_ERR(mtd);
+			goto err_probe;
+		}
+		if (!mtd) {
+			if (floor == 0)
+				goto notfound;
+			else
+				continue;
+		}
 		docg3_floors[floor] = mtd;
+		ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL,
+						0);
 		if (ret)
 			goto err_probe;
-		if (mtd)
-			found++;
+		found++;
 	}
 
 	ret = doc_register_sysfs(pdev, docg3_floors);