* [patch] touchscreen/bu21013_ts: null dereference in error handling
@ 2010-10-27 10:08 Dan Carpenter
2010-10-27 15:46 ` Dmitry Torokhov
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2010-10-27 10:08 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
If kzalloc() returned NULL then it would lead to a NULL deref after the
goto.
Signed-off-by: Dan Carpenter <error27@gmail.com>
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index ccde586..8f120b1 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
}
bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
+ if (!bu21013_data)
+ return -ENOMEM;
+
in_dev = input_allocate_device();
- if (!bu21013_data || !in_dev) {
+ if (!in_dev) {
dev_err(&client->dev, "device memory alloc failed\n");
error = -ENOMEM;
- goto err_free_mem;
+ goto err_free;
}
bu21013_data->in_dev = in_dev;
@@ -515,6 +518,7 @@ err_cs_disable:
pdata->cs_dis(pdata->cs_pin);
err_free_mem:
input_free_device(bu21013_data->in_dev);
+err_free:
kfree(bu21013_data);
return error;
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [patch] touchscreen/bu21013_ts: null dereference in error handling
2010-10-27 10:08 [patch] touchscreen/bu21013_ts: null dereference in error handling Dan Carpenter
@ 2010-10-27 15:46 ` Dmitry Torokhov
2010-10-27 20:26 ` [patch v2] " Dan Carpenter
0 siblings, 1 reply; 3+ messages in thread
From: Dmitry Torokhov @ 2010-10-27 15:46 UTC (permalink / raw)
To: Dan Carpenter
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
Hi Dan,
On Wed, Oct 27, 2010 at 12:08:22PM +0200, Dan Carpenter wrote:
> If kzalloc() returned NULL then it would lead to a NULL deref after the
> goto.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
Just changing the error path to do input_free_device(in_dev); is much
simpler.
>
> diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
> index ccde586..8f120b1 100644
> --- a/drivers/input/touchscreen/bu21013_ts.c
> +++ b/drivers/input/touchscreen/bu21013_ts.c
> @@ -446,11 +446,14 @@ static int __devinit bu21013_probe(struct i2c_client *client,
> }
>
> bu21013_data = kzalloc(sizeof(struct bu21013_ts_data), GFP_KERNEL);
> + if (!bu21013_data)
> + return -ENOMEM;
> +
> in_dev = input_allocate_device();
> - if (!bu21013_data || !in_dev) {
> + if (!in_dev) {
> dev_err(&client->dev, "device memory alloc failed\n");
> error = -ENOMEM;
> - goto err_free_mem;
> + goto err_free;
> }
>
> bu21013_data->in_dev = in_dev;
> @@ -515,6 +518,7 @@ err_cs_disable:
> pdata->cs_dis(pdata->cs_pin);
> err_free_mem:
> input_free_device(bu21013_data->in_dev);
> +err_free:
> kfree(bu21013_data);
>
> return error;
--
Dmitry
^ permalink raw reply [flat|nested] 3+ messages in thread* [patch v2] touchscreen/bu21013_ts: null dereference in error handling
2010-10-27 15:46 ` Dmitry Torokhov
@ 2010-10-27 20:26 ` Dan Carpenter
0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2010-10-27 20:26 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Henrik Rydberg, Naveen Kumar Gaddipati, Linus Walleij,
linux-input, kernel-janitors
In the original code "bu21013_data" could be NULL here.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
V2: same thing; different approach.
diff --git a/drivers/input/touchscreen/bu21013_ts.c b/drivers/input/touchscreen/bu21013_ts.c
index ccde586..2ca9e5d 100644
--- a/drivers/input/touchscreen/bu21013_ts.c
+++ b/drivers/input/touchscreen/bu21013_ts.c
@@ -514,7 +514,7 @@ err_free_irq:
err_cs_disable:
pdata->cs_dis(pdata->cs_pin);
err_free_mem:
- input_free_device(bu21013_data->in_dev);
+ input_free_device(in_dev);
kfree(bu21013_data);
return error;
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2010-10-27 20:26 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-10-27 10:08 [patch] touchscreen/bu21013_ts: null dereference in error handling Dan Carpenter
2010-10-27 15:46 ` Dmitry Torokhov
2010-10-27 20:26 ` [patch v2] " Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).