From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934692AbcLUX0q (ORCPT ); Wed, 21 Dec 2016 18:26:46 -0500 Received: from frisell.zx2c4.com ([192.95.5.64]:50354 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934452AbcLUXZp (ORCPT ); Wed, 21 Dec 2016 18:25:45 -0500 From: "Jason A. Donenfeld" To: David Woodhouse , Brian Norris , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Cc: "Jason A. Donenfeld" Subject: [PATCH] mtd/redboot: avoid null pointer deref Date: Thu, 22 Dec 2016 00:25:28 +0100 Message-Id: <20161221232528.26534-1-Jason@zx2c4.com> X-Mailer: git-send-email 2.11.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org By giving a bogus partition name, it's possible to trigger a null pointer dereference. Signed-off-by: Jason A. Donenfeld --- drivers/mtd/redboot.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c index 7623ac5fc586..53949ef80d36 100644 --- a/drivers/mtd/redboot.c +++ b/drivers/mtd/redboot.c @@ -212,6 +212,10 @@ static int parse_redboot_partitions(struct mtd_info *master, nrparts++; } + if (!fl) { + ret = -EINVAL; + goto out; + } #ifdef CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED if (fl->img->flash_base) { nrparts++; -- 2.11.0