* [patch] touchscreen/bu21013_ts: null dereference in error handling
@ 2010-10-27 10:08 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2010-10-27 10:08 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
If kzalloc() returned NULL then it would lead to a NULL deref after the
goto.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index ccde586..8f120b1 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
}
bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
+ if (!bu21013_data)
+ return -ENOMEM;
+
in_dev = input_allocate_device();
- if (!bu21013_data || !in_dev) {
+ if (!in_dev) {
dev_err(&client->dev, "device memory alloc failed\n");
error = -ENOMEM;
- goto err_free_mem;
+ goto err_free;
}
bu21013_data->in_dev = in_dev;
@@ -515,6 +518,7 @@ err_cs_disable:
pdata->cs_dis(pdata->cs_pin);
err_free_mem:
input_free_device(bu21013_data->in_dev);
+err_free:
kfree(bu21013_data);
return error;
^ permalink raw reply related [flat|nested] 6+ messages in thread* [patch] touchscreen/bu21013_ts: null dereference in error handling
@ 2010-10-27 10:08 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2010-10-27 10:08 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
If kzalloc() returned NULL then it would lead to a NULL deref after the
goto.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index ccde586..8f120b1 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
}
bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
+ if (!bu21013_data)
+ return -ENOMEM;
+
in_dev = input_allocate_device();
- if (!bu21013_data || !in_dev) {
+ if (!in_dev) {
dev_err(&client->dev, "device memory alloc failed\n");
error = -ENOMEM;
- goto err_free_mem;
+ goto err_free;
}
bu21013_data->in_dev = in_dev;
@@ -515,6 +518,7 @@ err_cs_disable:
pdata->cs_dis(pdata->cs_pin);
err_free_mem:
input_free_device(bu21013_data->in_dev);
+err_free:
kfree(bu21013_data);
return error;
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [patch] touchscreen/bu21013_ts: null dereference in error
2010-10-27 10:08 ` Dan Carpenter
@ 2010-10-27 15:46 ` Dmitry Torokhov
-1 siblings, 0 replies; 6+ messages in thread
From: Dmitry Torokhov @ 2010-10-27 15:46 UTC (permalink / raw)
To: Dan Carpenter
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
Hi Dan,
On Wed, Oct 27, 2010 at 12:08:22PM +0200, Dan Carpenter wrote:
> If kzalloc() returned NULL then it would lead to a NULL deref after the
> goto.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Just changing the error path to do input_free_device(in_dev); is much
simpler.
>
> diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
> index ccde586..8f120b1 100644
> --- a/drivers/input/touchscreen/bu21013_ts.c
> +++ b/drivers/input/touchscreen/bu21013_ts.c
> @@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
> }
>
> bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
> + if (!bu21013_data)
> + return -ENOMEM;
> +
> in_dev = input_allocate_device();
> - if (!bu21013_data || !in_dev) {
> + if (!in_dev) {
> dev_err(&client->dev, "device memory alloc failed\n");
> error = -ENOMEM;
> - goto err_free_mem;
> + goto err_free;
> }
>
> bu21013_data->in_dev = in_dev;
> @@ -515,6 +518,7 @@ err_cs_disable:
> pdata->cs_dis(pdata->cs_pin);
> err_free_mem:
> input_free_device(bu21013_data->in_dev);
> +err_free:
> kfree(bu21013_data);
>
> return error;
--
Dmitry
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [patch] touchscreen/bu21013_ts: null dereference in error handling
@ 2010-10-27 15:46 ` Dmitry Torokhov
0 siblings, 0 replies; 6+ messages in thread
From: Dmitry Torokhov @ 2010-10-27 15:46 UTC (permalink / raw)
To: Dan Carpenter
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
Hi Dan,
On Wed, Oct 27, 2010 at 12:08:22PM +0200, Dan Carpenter wrote:
> If kzalloc() returned NULL then it would lead to a NULL deref after the
> goto.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Just changing the error path to do input_free_device(in_dev); is much
simpler.
>
> diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
> index ccde586..8f120b1 100644
> --- a/drivers/input/touchscreen/bu21013_ts.c
> +++ b/drivers/input/touchscreen/bu21013_ts.c
> @@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
> }
>
> bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
> + if (!bu21013_data)
> + return -ENOMEM;
> +
> in_dev = input_allocate_device();
> - if (!bu21013_data || !in_dev) {
> + if (!in_dev) {
> dev_err(&client->dev, "device memory alloc failed\n");
> error = -ENOMEM;
> - goto err_free_mem;
> + goto err_free;
> }
>
> bu21013_data->in_dev = in_dev;
> @@ -515,6 +518,7 @@ err_cs_disable:
> pdata->cs_dis(pdata->cs_pin);
> err_free_mem:
> input_free_device(bu21013_data->in_dev);
> +err_free:
> kfree(bu21013_data);
>
> return error;
--
Dmitry
^ permalink raw reply [flat|nested] 6+ messages in thread* [patch v2] touchscreen/bu21013_ts: null dereference in error
2010-10-27 15:46 ` [patch] touchscreen/bu21013_ts: null dereference in error handling Dmitry Torokhov
@ 2010-10-27 20:26 ` Dan Carpenter
-1 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2010-10-27 20:26 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
In the original code "bu21013_data" could be NULL here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
V2: same thing; different approach.
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index ccde586..2ca9e5d 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -514,7 +514,7 @@ err_free_irq:
err_cs_disable:
pdata->cs_dis(pdata->cs_pin);
err_free_mem:
- input_free_device(bu21013_data->in_dev);
+ input_free_device(in_dev);
kfree(bu21013_data);
return error;
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [patch v2] touchscreen/bu21013_ts: null dereference in error handling
@ 2010-10-27 20:26 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2010-10-27 20:26 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
In the original code "bu21013_data" could be NULL here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
V2: same thing; different approach.
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index ccde586..2ca9e5d 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -514,7 +514,7 @@ err_free_irq:
err_cs_disable:
pdata->cs_dis(pdata->cs_pin);
err_free_mem:
- input_free_device(bu21013_data->in_dev);
+ input_free_device(in_dev);
kfree(bu21013_data);
return error;
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-10-27 20:26 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-10-27 10:08 [patch] touchscreen/bu21013_ts: null dereference in error handling Dan Carpenter
2010-10-27 10:08 ` Dan Carpenter
2010-10-27 15:46 ` [patch] touchscreen/bu21013_ts: null dereference in error Dmitry Torokhov
2010-10-27 15:46 ` [patch] touchscreen/bu21013_ts: null dereference in error handling Dmitry Torokhov
2010-10-27 20:26 ` [patch v2] touchscreen/bu21013_ts: null dereference in error Dan Carpenter
2010-10-27 20:26 ` [patch v2] touchscreen/bu21013_ts: null dereference in error handling Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.