reset: NULL deref on allocation failure

PATCH In review Dan Carpenter 3 participants 5 messages Apr 3, 2013 – Apr 9, 2013

Subsystems (2)

Kernel janitors Reset controller framework

lore

Share & tools

lore

Dan Carpenter

author

2013-04-03 05:02 UTC #0 lore raw

PATCH 1/1 reset: NULL deref on allocation failure

"rstc" is NULL here and we should use "rcdev" instead of "rstc->rcdev".

Signed-off-by Dan Carpenter <[email protected]>

drivers/reset/core.c +1 -1

index a258277..d1b6089 100644
@@ -181,7 +181,7 @@ struct reset_control *reset_control_get(struct device *dev, const char *id)
 
 	rstc = kzalloc(sizeof(*rstc), GFP_KERNEL);
 	if (!rstc) {
-		module_put(rstc->rcdev->owner);
+		module_put(rcdev->owner);
 		return ERR_PTR(-ENOMEM);
 	}

Philipp Zabel

maintainer Acked-by on v1 1/1

2013-04-04 07:49 UTC #1 lore raw

Hi Dan,

Am Mittwoch, den 03.04.2013, 08:02 +0300 schrieb Dan Carpenter:

Quoted 9 lines

"rstc" is NULL here and we should use "rcdev" instead of "rstc->rcdev".
Signed-off-by Dan Carpenter <[email protected]>
drivers/reset/core.c +0 -0
index a258277..d1b6089 100644

drivers/reset/core.c struct reset_control *reset_control_get(struct device *dev, const char *id) · line 186

Quoted 7 lines

drivers/reset/core.c +1 -1

@@ -181,7 +181,7 @@ struct reset_control *reset_control_get(struct device *dev, const char *id)
 
 	rstc = kzalloc(sizeof(*rstc), GFP_KERNEL);
 	if (!rstc) {
-		module_put(rstc->rcdev->owner);
+		module_put(rcdev->owner);
 		return ERR_PTR(-ENOMEM);
 	}

Acked-by Philipp Zabel <[email protected]>

thanks
Philipp

Shawn Guo

2013-04-04 11:56 UTC #2 lore raw

In reply to Dan Carpenter

Philipp,

Quoted 13 lines · Philipp Zabel

Hi Dan,
Am Mittwoch, den 03.04.2013, 08:02 +0300 schrieb Dan Carpenter:
Quoted 10 lines
"rstc" is NULL here and we should use "rcdev" instead of "rstc->rcdev".
Signed-off-by Dan Carpenter <[email protected]>
drivers/reset/core.c +0 -0
index a258277..d1b6089 100644
@@ -181,7 +181,7 @@ struct reset_control *reset_control_get(struct device *dev, const char *id)
 

Quoted 9 lines

drivers/reset/core.c struct reset_control *reset_control_get(struct device *dev, const char *id) · line 186
Quoted 6 lines
drivers/reset/core.c +1 -1
 	rstc = kzalloc(sizeof(*rstc), GFP_KERNEL);
 	if (!rstc) {
-		module_put(rstc->rcdev->owner);
+		module_put(rcdev->owner);
 		return ERR_PTR(-ENOMEM);
 	}
Acked-by Philipp Zabel <[email protected]>

I think you should take care of the patch to have it merged through the same path that the 'reset API' series goes to mainline.

Shawn

Dan Carpenter

author

2013-04-04 12:13 UTC #3 lore raw

In reply to Dan Carpenter

Quoted 3 lines · Shawn Guo

I think you should take care of the patch to have it merged through the same path that the 'reset API' series goes to mainline.

That's fine by me as well.

regards,
dan carpenter

Philipp Zabel

maintainer

2013-04-09 08:08 UTC #4 lore raw

In reply to Dan Carpenter

Am Donnerstag, den 04.04.2013, 15:13 +0300 schrieb Dan Carpenter:

Quoted 6 lines · Shawn Guo

Quoted 3 lines
I think you should take care of the patch to have it merged through the same path that the 'reset API' series goes to mainline.
That's fine by me as well.

Ok, I've added the patch on top of the branch
git://git.pengutronix.de/git/pza/linux.git reset/for_v3.10 for Olof to pull.

regards
Philipp