[PATCH 4/4] mtd: Check for allocation failures and bail out appropriately in init_msp_flash()

[Jesper Juhl]

    mtd: Check for allocation failures and bail out appropriately in init_msp_flash()
    
    Just trusting that a memory allocation succeeds is a bad habbit that
    can lead to null pointer dereferences fairly fast.
    In drivers/mtd/maps/pmcmsp-flash.c::init_msp_flash() there are a few
    allocations where I don't see anything guaranteeing that they will
    never fail, yet they are not checked for success...
    This patch adds checks for these allocations and also cleans up
    previous allocations properly in case one fails.
    
    Signed-off-by: Jesper Juhl <jesper.juhl at gmail.com>
---
 drivers/mtd/maps/pmcmsp-flash.c |   19 +++++++++++++++++--
 1 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c
index b6d382a..5472547 100644
--- a/drivers/mtd/maps/pmcmsp-flash.c
+++ b/drivers/mtd/maps/pmcmsp-flash.c
@@ -57,6 +57,7 @@ int __init init_msp_flash(void)
 	char flash_name[] = "flash0";
 	char part_name[] = "flash0_0";
 	unsigned addr, size;
+	int err = 0;
 
 	/* If ELB is disabled by "ful-mux" mode, we can't get at flash */
 	if ((*DEV_ID_REG & DEV_ID_SINGLE_PC) &&
@@ -74,8 +75,14 @@ int __init init_msp_flash(void)
 
 	printk(KERN_NOTICE "Found %d PMC flash devices\n", fcnt);
 	msp_flash = kmalloc(fcnt * sizeof(struct map_info *), GFP_KERNEL);
+	if (msp_flash == NULL)
+		goto out_mem;
 	msp_parts = kmalloc(fcnt * sizeof(struct mtd_partition *), GFP_KERNEL);
+	if (msp_parts == NULL)
+		goto out_mem_flash;
 	msp_maps = kcalloc(fcnt, sizeof(struct mtd_info), GFP_KERNEL);
+	if (msp_maps == NULL)
+		goto out_mem_parts;
 
 	/* loop over the flash devices, initializing each */
 	for (i = 0; i < fcnt; i++) {
@@ -122,7 +129,7 @@ int __init init_msp_flash(void)
 
 		msp_maps[i].name = kmalloc(7, GFP_KERNEL);
 		if (msp_maps[i].name == NULL)
-			return -ENOMEM;
+			goto out_mem;
 		strncpy(msp_maps[i].name, flash_name, 7);
 
 		msp_maps[i].bankwidth = 1;
@@ -153,7 +160,15 @@ int __init init_msp_flash(void)
 		}
 	}
 
-	return 0;
+out:
+	return err;
+out_mem_parts:
+	kfree(parts);
+out_mem_flash:
+	kfree(flash);
+out_mem:
+	err = -ENOMEM;
+	goto out;
 }
 
 static void __exit cleanup_msp_flash(void)