[PATCH] firmware: fix request_firmware() error handling

[PATCH] firmware: fix request_firmware() error handling

[Pekka Enberg]

If _request_firmware() fails and we do release_firmware(), update the pointer
pointed to by 'firmware_p' so that we don't return a free'd pointer to the
caller.

This patch fixes a boot-time crash on my MacBook that's caused by failing
isight_firmware_load(). The bug was introduced in commit f8a4bd34 ("firmware
loader: embed device into firmware_priv structure") and makes 2.6.36-rc1
unusable on my box.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
---
Here's a picture of the oops:

  http://twitpic.com/2h76gv

Unfortunately I don't have a serial console hooked up so I couldn't get a text
version of it.

 drivers/base/firmware_class.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index c8a44f5..40af43e 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -568,7 +568,7 @@ static int _request_firmware(const struct firmware **firmware_p,
 out:
 	if (retval) {
 		release_firmware(firmware);
-		firmware_p = NULL;
+		*firmware_p = NULL;
 	}
 
 	return retval;
-- 
1.6.3.3

Re: [PATCH] firmware: fix request_firmware() error handling

[Greg KH]

On Sun, Aug 22, 2010 at 06:09:30PM +0300, Pekka Enberg wrote:
> If _request_firmware() fails and we do release_firmware(), update the pointer
> pointed to by 'firmware_p' so that we don't return a free'd pointer to the
> caller.
> 
> This patch fixes a boot-time crash on my MacBook that's caused by failing
> isight_firmware_load(). The bug was introduced in commit f8a4bd34 ("firmware
> loader: embed device into firmware_priv structure") and makes 2.6.36-rc1
> unusable on my box.
> 
> Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
> Signed-off-by: Pekka Enberg <penberg@kernel.org>

Thanks, already in my tree and linux-next and will be going to Linus on
Monday.

greg k-h