AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

mmc: moxart: Fix null pointer dereference on pointer host

Browse Source 
commit 0eab756f8821d255016c63bb55804c429ff4bdb1 upstream.

There are several error return paths that dereference the null pointer
host because the pointer has not yet been set to a valid value.
Fix this by adding a new out_mmc label and exiting via this label
to avoid the host clean up and hence the null pointer dereference.

Addresses-Coverity: ("Explicit null dereference")
Fixes: 8105c2abbf36 ("mmc: moxart: Fix reference count leaks in moxart_probe")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20211013100052.125461-1-colin.king@canonical.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Colin Ian King 2021-10-13 11:00:52 +01:00 committed by Greg Kroah-Hartman
parent 188bf40391
commit 1e7340950d
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/mmc/host/moxart-mmc.c
View File

@ -569,37 +569,37 @@ static int moxart_probe(struct platform_device *pdev)
if (!mmc) { if (!mmc) {
dev_err(dev, "mmc_alloc_host failed\n"); dev_err(dev, "mmc_alloc_host failed\n");
ret = -ENOMEM; ret = -ENOMEM;
goto out; goto out_mmc;
} }
ret = of_address_to_resource(node, 0, &res_mmc); ret = of_address_to_resource(node, 0, &res_mmc);
if (ret) { if (ret) {
dev_err(dev, "of_address_to_resource failed\n"); dev_err(dev, "of_address_to_resource failed\n");
goto out; goto out_mmc;
} }
irq = irq_of_parse_and_map(node, 0); irq = irq_of_parse_and_map(node, 0);
if (irq <= 0) { if (irq <= 0) {
dev_err(dev, "irq_of_parse_and_map failed\n"); dev_err(dev, "irq_of_parse_and_map failed\n");
ret = -EINVAL; ret = -EINVAL;
goto out; goto out_mmc;
} }
clk = devm_clk_get(dev, NULL); clk = devm_clk_get(dev, NULL);
if (IS_ERR(clk)) { if (IS_ERR(clk)) {
ret = PTR_ERR(clk); ret = PTR_ERR(clk);
goto out; goto out_mmc;
} }
reg_mmc = devm_ioremap_resource(dev, &res_mmc); reg_mmc = devm_ioremap_resource(dev, &res_mmc);
if (IS_ERR(reg_mmc)) { if (IS_ERR(reg_mmc)) {
ret = PTR_ERR(reg_mmc); ret = PTR_ERR(reg_mmc);
goto out; goto out_mmc;
} }
ret = mmc_of_parse(mmc); ret = mmc_of_parse(mmc);
if (ret) if (ret)
goto out; goto out_mmc;
host = mmc_priv(mmc); host = mmc_priv(mmc);
host->mmc = mmc; host->mmc = mmc;
@ -690,6 +690,7 @@ static int moxart_probe(struct platform_device *pdev)
dma_release_channel(host->dma_chan_tx); dma_release_channel(host->dma_chan_tx);
if (!IS_ERR_OR_NULL(host->dma_chan_rx)) if (!IS_ERR_OR_NULL(host->dma_chan_rx))
dma_release_channel(host->dma_chan_rx); dma_release_channel(host->dma_chan_rx);
out_mmc:
if (mmc) if (mmc)
mmc_free_host(mmc); mmc_free_host(mmc);
return ret; return ret;