[PATCH Resend] mfd: asic3: Fix potential null pointer dereference

[PATCH Resend] mfd: asic3: Fix potential null pointer dereference

[Sachin Kamat]

We previously assumed 'mem_sdio' could be null but it is
dereferenced in ioremap(). Add a check to avoid a potential
null pointer dereference error.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
---
 drivers/mfd/asic3.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 9f6294f2a070..9fc4186d4132 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -899,13 +899,15 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
 	ds1wm_resources[0].end   >>= asic->bus_shift;
 
 	/* MMC */
-	asic->tmio_cnf = ioremap((ASIC3_SD_CONFIG_BASE >> asic->bus_shift) +
+	if (mem_sdio) {
+		asic->tmio_cnf = ioremap((ASIC3_SD_CONFIG_BASE >> asic->bus_shift) +
 				 mem_sdio->start,
 				 ASIC3_SD_CONFIG_SIZE >> asic->bus_shift);
-	if (!asic->tmio_cnf) {
-		ret = -ENOMEM;
-		dev_dbg(asic->dev, "Couldn't ioremap SD_CONFIG\n");
-		goto out;
+		if (!asic->tmio_cnf) {
+			ret = -ENOMEM;
+			dev_dbg(asic->dev, "Couldn't ioremap SD_CONFIG\n");
+			goto out;
+		}
 	}
 	asic3_mmc_resources[0].start >>= asic->bus_shift;
 	asic3_mmc_resources[0].end   >>= asic->bus_shift;
-- 
1.7.9.5

Re: [PATCH Resend] mfd: asic3: Fix potential null pointer dereference

[Lee Jones]

On Tue, 10 Jun 2014, Sachin Kamat wrote:

> We previously assumed 'mem_sdio' could be null but it is
> dereferenced in ioremap(). Add a check to avoid a potential
> null pointer dereference error.
> 
> Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
> ---
>  drivers/mfd/asic3.c |   12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)

Applied, thanks.

> diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
> index 9f6294f2a070..9fc4186d4132 100644
> --- a/drivers/mfd/asic3.c
> +++ b/drivers/mfd/asic3.c
> @@ -899,13 +899,15 @@ static int __init asic3_mfd_probe(struct platform_device *pdev,
>  	ds1wm_resources[0].end   >>= asic->bus_shift;
>  
>  	/* MMC */
> -	asic->tmio_cnf = ioremap((ASIC3_SD_CONFIG_BASE >> asic->bus_shift) +
> +	if (mem_sdio) {
> +		asic->tmio_cnf = ioremap((ASIC3_SD_CONFIG_BASE >> asic->bus_shift) +
>  				 mem_sdio->start,
>  				 ASIC3_SD_CONFIG_SIZE >> asic->bus_shift);
> -	if (!asic->tmio_cnf) {
> -		ret = -ENOMEM;
> -		dev_dbg(asic->dev, "Couldn't ioremap SD_CONFIG\n");
> -		goto out;
> +		if (!asic->tmio_cnf) {
> +			ret = -ENOMEM;
> +			dev_dbg(asic->dev, "Couldn't ioremap SD_CONFIG\n");
> +			goto out;
> +		}
>  	}
>  	asic3_mmc_resources[0].start >>= asic->bus_shift;
>  	asic3_mmc_resources[0].end   >>= asic->bus_shift;

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog