mtd: Fix kernel NULL pointer dereference in physmap.c (4b56ffca) · Commits · 戴 / test

During the probe for physmap platform flash devices there are a number error exit conditions that all do a goto err_out which then calls physmap_flash_remove(). In that function one of the cleanup steps is: #ifdef CONFIG_MTD_CONCAT if (info->cmtd != info->mtd[0]) mtd_concat_destroy(info->cmtd); #endif This test will succeed since info->cmtd == NULL and info->mtd[0] is valid. Fix this by exiting the remove function when info->cmtd == NULL. Also, cleanup the #ifdef CONFIG_MTD_PARTITIONS stuff by using mtd_has_partitions(). Signed-off-by:

H Hartley Sweeten <hsweeten@visionengravers.com> Signed-off-by:

David Woodhouse <David.Woodhouse@intel.com>

drivers/mtd/maps/physmap.c

+25 −24

Original line number	Diff line number	Diff line
		@@ -44,22 +44,23 @@ static int physmap_flash_remove(struct platform_device *dev)
		return 0;
		platform_set_drvdata(dev, NULL);

		if (info->cmtd == NULL)
		return 0;

		physmap_data = dev->dev.platform_data;

		if (info->cmtd) {
		#ifdef CONFIG_MTD_PARTITIONS
		if (info->nr_parts \|\| physmap_data->nr_parts)
		if (mtd_has_partitions()) {
		if (info->nr_parts \|\| physmap_data->nr_parts) {
		del_mtd_partitions(info->cmtd);
		else

		if (info->nr_parts)
		kfree(info->parts);
		} else {
		del_mtd_device(info->cmtd);
		#else
		}
		} else {
		del_mtd_device(info->cmtd);
		#endif
		}
		#ifdef CONFIG_MTD_PARTITIONS
		if (info->nr_parts)
		kfree(info->parts);
		#endif

		#ifdef CONFIG_MTD_CONCAT
		if (info->cmtd != info->mtd[0])
		@@ -169,7 +170,7 @@ static int physmap_flash_probe(struct platform_device *dev)
		if (err)
		goto err_out;

		#ifdef CONFIG_MTD_PARTITIONS
		if (mtd_has_partitions()) {
		err = parse_mtd_partitions(info->cmtd, part_probe_types,
		&info->parts, 0);
		if (err > 0) {
		@@ -184,7 +185,7 @@ static int physmap_flash_probe(struct platform_device *dev)
		physmap_data->nr_parts);
		return 0;
		}
		#endif
		}

		add_mtd_device(info->cmtd);
		return 0;

Admin message