mtd: physmap: fix NULL pointer dereference in error path (d58ab5cf) · Commits · 戴 / test

commit ("[MTD] [MAPS] physmap: fix wrong free and del_mtd_{partition,device}") introduces a NULL pointer dereference in physmap_flash_remove when called from the error path in physmap_flash_probe (if map_probe failed). Call del_mtd_{partition,device} only if info->cmtd was not NULL. Reported-by:

pHilipp Zabel <philipp.zabel@gmail.com> Signed-off-by:

Atsushi Nemoto <anemo@mba.ocn.ne.jp> Cc: David Woodhouse <dwmw2@infradead.org> Cc: "Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

drivers/mtd/maps/physmap.c

+11 −8

Original line number	Original line	Diff line number	Diff line
	@@ -46,17 +46,20 @@ static int physmap_flash_remove(struct platform_device *dev)

	physmap_data = dev->dev.platform_data;		physmap_data = dev->dev.platform_data;

			if (info->cmtd) {
	#ifdef CONFIG_MTD_PARTITIONS		#ifdef CONFIG_MTD_PARTITIONS
	if (info->nr_parts) {		if (info->nr_parts \|\| physmap_data->nr_parts)
	del_mtd_partitions(info->cmtd);
	kfree(info->parts);
	} else if (physmap_data->nr_parts)
	del_mtd_partitions(info->cmtd);		del_mtd_partitions(info->cmtd);
	else		else
	del_mtd_device(info->cmtd);		del_mtd_device(info->cmtd);
	#else		#else
	del_mtd_device(info->cmtd);		del_mtd_device(info->cmtd);
	#endif		#endif
			}
			#ifdef CONFIG_MTD_PARTITIONS
			if (info->nr_parts)
			kfree(info->parts);
			#endif

	#ifdef CONFIG_MTD_CONCAT		#ifdef CONFIG_MTD_CONCAT
	if (info->cmtd != info->mtd[0])		if (info->cmtd != info->mtd[0])

Admin message