diff mbox

video: fbdev: pxafb: potential NULL dereference on error

Message ID 20160715110732.GC9258@mwanda (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter July 15, 2016, 11:07 a.m. UTC
If we "goto out;" then it calls display_timings_release(timings);
Since "timings" is NULL, that's going to oops.  Just return directly.

Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Robert Jarzmik July 17, 2016, 3:20 p.m. UTC | #1
Dan Carpenter <dan.carpenter@oracle.com> writes:

> If we "goto out;" then it calls display_timings_release(timings);
> Since "timings" is NULL, that's going to oops.  Just return directly.
>
> Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>

Cheers.

--
Robert
--
To unsubscribe from this list: send the line "unsubscribe linux-fbdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Tomi Valkeinen Aug. 10, 2016, 10:56 a.m. UTC | #2
On 15/07/16 14:07, Dan Carpenter wrote:
> If we "goto out;" then it calls display_timings_release(timings);
> Since "timings" is NULL, that's going to oops.  Just return directly.
> 
> Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
> index 2c0487f..ed41fdb 100644
> --- a/drivers/video/fbdev/pxafb.c
> +++ b/drivers/video/fbdev/pxafb.c
> @@ -2125,7 +2125,7 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
>  
>  	timings = of_get_display_timings(disp);
>  	if (!timings)
> -		goto out;
> +		return -EINVAL;
>  
>  	ret = -ENOMEM;
>  	info->modes = kmalloc_array(timings->num_timings,
> 

Thanks, queued for v4.9.

 Tomi
diff mbox

Patch

diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
index 2c0487f..ed41fdb 100644
--- a/drivers/video/fbdev/pxafb.c
+++ b/drivers/video/fbdev/pxafb.c
@@ -2125,7 +2125,7 @@  static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
 
 	timings = of_get_display_timings(disp);
 	if (!timings)
-		goto out;
+		return -EINVAL;
 
 	ret = -ENOMEM;
 	info->modes = kmalloc_array(timings->num_timings,