diff mbox

[[PATCH,v2] mtd: check parts pointer before using it

Message ID 1314185188-6151-1-git-send-email-jason.hui@linaro.org
State Accepted
Commit 4d523b60ef9d1953d9e12745ca0ed3e2dc98c189
Headers show

Commit Message

Jason Hui Aug. 24, 2011, 11:26 a.m. UTC
The code has the check for parts but it called after kmemdup,
kmemdup(parts, sizeof(*parts) * nr_parts,...)
if (!parts)
	return -ENOMEM

In fact, we need check parts before safely using it.
and we also need check the real_parts to make sure kmemdup
allocation sucessfully.

Signed-off-by: Jason Liu <jason.hui@linaro.org>
Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Cc: Artem Bityutskiy <artem.bityutskiy@intel.com>
---
V2: Fix one error condition check and add real_parts check too.
---
This patch is based on git://git.infradead.org/users/dedekind/l2-mtd-2.6.git
---
 drivers/mtd/mtdcore.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

Comments

Jason Liu Sept. 13, 2011, 6:31 a.m. UTC | #1
Hi, Artem,

2011/8/24 Jason Liu <jason.hui@linaro.org>:
> The code has the check for parts but it called after kmemdup,
> kmemdup(parts, sizeof(*parts) * nr_parts,...)
> if (!parts)
>        return -ENOMEM
>
> In fact, we need check parts before safely using it.
> and we also need check the real_parts to make sure kmemdup
> allocation sucessfully.
>
> Signed-off-by: Jason Liu <jason.hui@linaro.org>
> Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
> Cc: Artem Bityutskiy <artem.bityutskiy@intel.com>
> ---
> V2: Fix one error condition check and add real_parts check too.
> ---
> This patch is based on git://git.infradead.org/users/dedekind/l2-mtd-2.6.git
> ---
>  drivers/mtd/mtdcore.c |    7 ++++---
>  1 files changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
> index 09bdbac..b01993e 100644
> --- a/drivers/mtd/mtdcore.c
> +++ b/drivers/mtd/mtdcore.c
> @@ -465,12 +465,13 @@ int mtd_device_parse_register(struct mtd_info *mtd, const char **types,
>        struct mtd_partition *real_parts;
>
>        err = parse_mtd_partitions(mtd, types, &real_parts, parser_data);
> -       if (err <= 0 && nr_parts) {
> +       if (err <= 0 && nr_parts && parts) {
>                real_parts = kmemdup(parts, sizeof(*parts) * nr_parts,
>                                     GFP_KERNEL);
> -               err = nr_parts;
> -               if (!parts)
> +               if (!real_parts)
>                        err = -ENOMEM;
> +               else
> +                       err = nr_parts;
>        }
>
>        if (err > 0) {
> --
> 1.7.4.1

Ping, any comments about it? Thanks,

Jason

>
>
>
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
>
Artem Bityutskiy Sept. 13, 2011, 6:44 a.m. UTC | #2
On Tue, 2011-09-13 at 14:31 +0800, Jason Liu wrote:
> Ping, any comments about it? Thanks,

I was sure I answered you, sorry - your patch is for long time in my l2
tree and hence, in linux-next.
Jason Liu Sept. 13, 2011, 6:55 a.m. UTC | #3
Hi, Atrem,

2011/9/13 Artem Bityutskiy <dedekind1@gmail.com>:
> On Tue, 2011-09-13 at 14:31 +0800, Jason Liu wrote:
>> Ping, any comments about it? Thanks,
>
> I was sure I answered you, sorry - your patch is for long time in my l2
> tree and hence, in linux-next.

 I'm not aware of it. Thanks Artem.

Jason

>
> --
> Best Regards,
> Artem Bityutskiy
>
>
diff mbox

Patch

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 09bdbac..b01993e 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -465,12 +465,13 @@  int mtd_device_parse_register(struct mtd_info *mtd, const char **types,
 	struct mtd_partition *real_parts;
 
 	err = parse_mtd_partitions(mtd, types, &real_parts, parser_data);
-	if (err <= 0 && nr_parts) {
+	if (err <= 0 && nr_parts && parts) {
 		real_parts = kmemdup(parts, sizeof(*parts) * nr_parts,
 				     GFP_KERNEL);
-		err = nr_parts;
-		if (!parts)
+		if (!real_parts)
 			err = -ENOMEM;
+		else
+			err = nr_parts;
 	}
 
 	if (err > 0) {