From mboxrd@z Thu Jan 1 00:00:00 1970 From: Cong Ding Subject: [PATCH v3] i2c: busses/i2c-pxa.c: fix potential null pointer dereference error Date: Thu, 14 Feb 2013 12:28:18 +0100 Message-ID: <20130214112818.GA18774@gmail.com> References: <1360015899-13706-1-git-send-email-dinggnu@gmail.com> <20130205000517.GB9969@gmail.com> <20130205102540.GC9969@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Haojian Zhuang Cc: Kyungmin Park , Wolfram Sang , Andrew Morton , Karol Lewandowski , Haojian Zhuang , linux-i2c@vger.kernel.org, "linux-kernel@vger.kernel.org" List-Id: linux-i2c@vger.kernel.org If it goes to eclk through line 1107, the variable res would be NULL. It will cause a null pointer dereference error if we call release_mem_region. The correct way should be using devm_kzalloc rather than kzalloc to allocate memory. Signed-off-by: Cong Ding --- drivers/i2c/busses/i2c-pxa.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c index 1034d93..dd2d640 100644 --- a/drivers/i2c/busses/i2c-pxa.c +++ b/drivers/i2c/busses/i2c-pxa.c @@ -1094,29 +1094,23 @@ static int i2c_pxa_probe(struct platform_device *dev) struct resource *res = NULL; int ret, irq; - i2c = kzalloc(sizeof(struct pxa_i2c), GFP_KERNEL); - if (!i2c) { - ret = -ENOMEM; - goto emalloc; - } + i2c = devm_kzalloc(sizeof(struct pxa_i2c), GFP_KERNEL); + if (!i2c) + return -ENOMEM; ret = i2c_pxa_probe_dt(dev, i2c, &i2c_type); if (ret > 0) ret = i2c_pxa_probe_pdata(dev, i2c, &i2c_type); if (ret < 0) - goto eclk; + return ret; res = platform_get_resource(dev, IORESOURCE_MEM, 0); irq = platform_get_irq(dev, 0); - if (res == NULL || irq < 0) { - ret = -ENODEV; - goto eclk; - } + if (res == NULL || irq < 0) + return -ENODEV; - if (!request_mem_region(res->start, resource_size(res), res->name)) { - ret = -ENOMEM; - goto eclk; - } + if (!request_mem_region(res->start, resource_size(res), res->name)) + return -ENOMEM; i2c->adap.owner = THIS_MODULE; i2c->adap.retries = 5; -- 1.7.9.5