[PATCH] regmap: Make sure regmap_init() returns non-NULL on failure

[PATCH] regmap: Make sure regmap_init() returns non-NULL on failure

[Geert Uytterhoeven]

Commit d647c199510c2c12 ("regmap: add DT endianness binding support.")
added two extra users of the "ret" variable in regmap_init(), to store
the error code returned by of_regmap_get_endian().  Thus from this point
on, "ret" is zero in case of success.

However, most failure paths after that rely on "ret" being
pre-initialized to -EINVAL. If any of the format checks fails,
regmap_init() will return a NULL pointer instead of an error code
wrapped in an ERR_PTR().

As a typical regmap_init*() error check looks like:

	wm8978->regmap = devm_regmap_init_i2c(i2c, &wm8978_regmap_config);
	if (IS_ERR(wm8978->regmap)) {
		...
	}

failures are no longer caught, and the code will crash later.  This is
the real reason behind the NULL pointer dereference reported by Javier
Martinez Canillas.

While his commit ba1b53feb8cacbd8 ("regmap: Fix DT endianess parsing
logic") fixed the mis-initialization of regmap parameters, the NULL
pointer dereference will still happen in case of a legitimate error.

Add a catch-all rule at the end of the failure path to fix this.

Fixes: commit d647c199510c2c12 ("regmap: add DT endianness binding
support.")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/base/regmap/regmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 44c2df8284d7..ab3238327d0a 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -912,6 +912,8 @@ err_range:
 err_map:
 	kfree(map);
 err:
+	if (!ret)
+		ret = -EINVAL;
 	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(regmap_init);
-- 
1.9.1

Re: [PATCH] regmap: Make sure regmap_init() returns non-NULL on failure

[Geert Uytterhoeven]

This is against today's regmap/for-next.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH] regmap: Make sure regmap_init() returns non-NULL on failure

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 347 bytes --]

On Wed, Aug 27, 2014 at 04:06:16PM +0200, Geert Uytterhoeven wrote:
> Commit d647c199510c2c12 ("regmap: add DT endianness binding support.")
> added two extra users of the "ret" variable in regmap_init(), to store
> the error code returned by of_regmap_get_endian().  Thus from this point
> on, "ret" is zero in case of success.

Applied, thanks.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]