[ARM] pxa: avoid NULL dereferencing in error handling of ssp.c (077de1ad) · Commits · 戴 / test

The assignments of res to the results of the two calls to platform_get_resource make it impossible to use res in the error handling code in the arguments to release_mem_region. The semantic match that finds the former problem is as follows: (http://coccinelle.lip6.fr/ ) // <smpl> @r exists@ expression E, E1; identifier f; statement S1,S3; iterator iter; @@ if ((E == NULL && ...) || ...) { ... when != false ((E == NULL && ...) || ...) when != true ((E != NULL && ...) || ...) when != iter(E,...) S1 when != E = E1 ( sizeof(E->f) | * E->f ) ... when any return ...; } else S3 // </smpl> Signed-off-by:

Julia Lawall <julia@diku.dk> Signed-off-by:

Eric Miao <eric.y.miao@gmail.com>

arch/arm/plat-pxa/ssp.c

+16 −16

Original line number	Diff line number	Diff line
		@@ -92,6 +92,22 @@ static int __devinit ssp_probe(struct platform_device *pdev)
		goto err_free;
		}

		res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
		if (res == NULL) {
		dev_err(&pdev->dev, "no SSP RX DRCMR defined\n");
		ret = -ENODEV;
		goto err_free_clk;
		}
		ssp->drcmr_rx = res->start;

		res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
		if (res == NULL) {
		dev_err(&pdev->dev, "no SSP TX DRCMR defined\n");
		ret = -ENODEV;
		goto err_free_clk;
		}
		ssp->drcmr_tx = res->start;

		res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
		if (res == NULL) {
		dev_err(&pdev->dev, "no memory resource defined\n");
		@@ -123,22 +139,6 @@ static int __devinit ssp_probe(struct platform_device *pdev)
		goto err_free_io;
		}

		res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
		if (res == NULL) {
		dev_err(&pdev->dev, "no SSP RX DRCMR defined\n");
		ret = -ENODEV;
		goto err_free_io;
		}
		ssp->drcmr_rx = res->start;

		res = platform_get_resource(pdev, IORESOURCE_DMA, 1);
		if (res == NULL) {
		dev_err(&pdev->dev, "no SSP TX DRCMR defined\n");
		ret = -ENODEV;
		goto err_free_io;
		}
		ssp->drcmr_tx = res->start;

		/* PXA2xx/3xx SSP ports starts from 1 and the internal pdev->id
		* starts from 0, do a translation here
		*/

Admin message