diff options
| author | Boris Brezillon <boris.brezillon@bootlin.com> | 2018-07-19 22:53:50 +0200 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2018-07-31 09:45:51 +0200 |
| commit | bdc4e58d5395fb45e22a54e01312f1abb22523ef (patch) | |
| tree | ec023835f1b4ce202ac8f43f81ab62c9253bc360 /drivers | |
| parent | 760c435e0f85ed19e48a90d746ce1de2cd02def7 (diff) | |
mtd: rawnand: s3c2410: Error out when ->nrsets < 0 or ->sets == NULL
All of the code in the probe path assumes ->sets != NULL and
->nrsets > 0. Error out if that's not the case to avoid dereferencing a
NULL pointer.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/mtd/nand/raw/s3c2410.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/drivers/mtd/nand/raw/s3c2410.c b/drivers/mtd/nand/raw/s3c2410.c index 10d81f367d26..5a4a68790653 100644 --- a/drivers/mtd/nand/raw/s3c2410.c +++ b/drivers/mtd/nand/raw/s3c2410.c @@ -1134,8 +1134,13 @@ static int s3c24xx_nand_probe(struct platform_device *pdev) dev_dbg(&pdev->dev, "mapped registers at %p\n", info->regs); - sets = (plat != NULL) ? plat->sets : NULL; - nr_sets = (plat != NULL) ? plat->nr_sets : 1; + if (!plat->sets || plat->nr_sets < 1) { + err = -EINVAL; + goto exit_error; + } + + sets = plat->sets; + nr_sets = plat->nr_sets; info->mtd_count = nr_sets; @@ -1152,7 +1157,7 @@ static int s3c24xx_nand_probe(struct platform_device *pdev) nmtd = info->mtds; - for (setno = 0; setno < nr_sets; setno++, nmtd++) { + for (setno = 0; setno < nr_sets; setno++, nmtd++, sets++) { struct mtd_info *mtd = nand_to_mtd(&nmtd->chip); pr_debug("initialising set %d (%p, info %p)\n", @@ -1174,9 +1179,6 @@ static int s3c24xx_nand_probe(struct platform_device *pdev) goto exit_error; s3c2410_nand_add_partition(info, nmtd, sets); - - if (sets != NULL) - sets++; } /* initialise the hardware */ |