[PATCH 1/7] mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error

[PATCH 1/7] mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error

[Krzysztof Kozlowski]

During probe the driver allocates dummy I2C device for companion chip
with i2c_new_dummy() but it does not check the return value of this call.

In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by regmap_init_i2c().

If i2c_new_dummy() fails for companion device, fail also the probe for
main MFD driver.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Cc: stable@vger.kernel.org
---
 drivers/mfd/88pm860x-core.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
index c9b1f6422941..e456be9a7c67 100644
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_client *client,
 		chip->companion_addr = pdata->companion_addr;
 		chip->companion = i2c_new_dummy(chip->client->adapter,
 						chip->companion_addr);
+		if (!chip->companion) {
+			dev_err(&client->dev,
+				"Failed to allocate I2C companion device\n");
+			return -ENODEV;
+		}
 		chip->regmap_companion = regmap_init_i2c(chip->companion,
 							&pm860x_regmap_config);
 		if (IS_ERR(chip->regmap_companion)) {
-- 
1.7.9.5

[PATCH 2/7] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail

[Krzysztof Kozlowski]

During probe the driver allocates dummy I2C device for companion chip
and then allocates a regmap for it. If regmap_init_i2c() fails then the
I2C driver (allocated with i2c_new_dummy()) is not freed and this
resource leaks.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Cc: stable@vger.kernel.org
---
 drivers/mfd/88pm860x-core.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
index e456be9a7c67..bcfc9e85b4a0 100644
--- a/drivers/mfd/88pm860x-core.c
+++ b/drivers/mfd/88pm860x-core.c
@@ -1190,6 +1190,7 @@ static int pm860x_probe(struct i2c_client *client,
 			ret = PTR_ERR(chip->regmap_companion);
 			dev_err(&chip->companion->dev,
 				"Failed to allocate register map: %d\n", ret);
+			i2c_unregister_device(chip->companion);
 			return ret;
 		}
 		i2c_set_clientdata(chip->companion, chip);
-- 
1.7.9.5

[PATCH 3/7] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error

[Krzysztof Kozlowski]

During probe the driver allocates dummy I2C device for RTC with
i2c_new_dummy() but it does not check the return value of this call.

In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().

If i2c_new_dummy() fails for RTC device, fail also the probe for main
MFD driver.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Cc: stable@vger.kernel.org
---
 drivers/mfd/max77686.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
index f53d5823a3f7..e5fce765accb 100644
--- a/drivers/mfd/max77686.c
+++ b/drivers/mfd/max77686.c
@@ -121,6 +121,10 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
 		dev_info(max77686->dev, "device found\n");
 
 	max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+	if (!max77686->rtc) {
+		dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max77686->rtc, max77686);
 
 	max77686_irq_init(max77686);
-- 
1.7.9.5

[PATCH 4/7] mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error

[Krzysztof Kozlowski]

During probe the driver allocates dummy I2C devices for MUIC and haptic
with i2c_new_dummy() but it does not check the return value of this
calls.

In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by devm_regmap_init_i2c() and i2c_unregister_device().

If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe
for main MFD driver.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Cc: stable@vger.kernel.org
---
 drivers/mfd/max77693.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index e0859987ab6b..c5535f018466 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -148,9 +148,18 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 		dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
 
 	max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+	if (!max77693->muic) {
+		dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max77693->muic, max77693);
 
 	max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+	if (!max77693->haptic) {
+		dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n");
+		ret = -ENODEV;
+		goto err_i2c_haptic;
+	}
 	i2c_set_clientdata(max77693->haptic, max77693);
 
 	/*
@@ -184,8 +193,9 @@ err_mfd:
 	max77693_irq_exit(max77693);
 err_irq:
 err_regmap_muic:
-	i2c_unregister_device(max77693->muic);
 	i2c_unregister_device(max77693->haptic);
+err_i2c_haptic:
+	i2c_unregister_device(max77693->muic);
 	return ret;
 }
 
-- 
1.7.9.5

[PATCH 5/7] mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error

[Krzysztof Kozlowski]

During probe the driver allocates dummy I2C devices for RTC and ADC
with i2c_new_dummy() but it does not check the return value of this
calls.

In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().

If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe
for main MFD driver.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Cc: stable@vger.kernel.org
---
 drivers/mfd/max8925-i2c.c |    9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/mfd/max8925-i2c.c b/drivers/mfd/max8925-i2c.c
index 176aa26fc787..a83eed5c15ca 100644
--- a/drivers/mfd/max8925-i2c.c
+++ b/drivers/mfd/max8925-i2c.c
@@ -181,9 +181,18 @@ static int max8925_probe(struct i2c_client *client,
 	mutex_init(&chip->io_lock);
 
 	chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR);
+	if (!chip->rtc) {
+		dev_err(chip->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(chip->rtc, chip);
 
 	chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR);
+	if (!chip->adc) {
+		dev_err(chip->dev, "Failed to allocate I2C device for ADC\n");
+		i2c_unregister_device(chip->rtc);
+		return -ENODEV;
+	}
 	i2c_set_clientdata(chip->adc, chip);
 
 	device_init_wakeup(&client->dev, 1);
-- 
1.7.9.5

[PATCH 6/7] mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error

[Krzysztof Kozlowski]

During probe the driver allocates dummy I2C devices for RTC, haptic and
MUIC with i2c_new_dummy() but it does not check the return value of this
calls.

In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().

If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the
probe for main MFD driver.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Cc: stable@vger.kernel.org
---
 drivers/mfd/max8997.c |   18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
index be88a3bf7b85..3ffc11dfc3b6 100644
--- a/drivers/mfd/max8997.c
+++ b/drivers/mfd/max8997.c
@@ -208,10 +208,26 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
 	mutex_init(&max8997->iolock);
 
 	max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
+	if (!max8997->rtc) {
+		dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max8997->rtc, max8997);
+
 	max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
+	if (!max8997->haptic) {
+		dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n");
+		ret = -ENODEV;
+		goto err_i2c_haptic;
+	}
 	i2c_set_clientdata(max8997->haptic, max8997);
+
 	max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
+	if (!max8997->muic) {
+		dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n");
+		ret = -ENODEV;
+		goto err_i2c_muic;
+	}
 	i2c_set_clientdata(max8997->muic, max8997);
 
 	pm_runtime_set_active(max8997->dev);
@@ -239,7 +255,9 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
 err_mfd:
 	mfd_remove_devices(max8997->dev);
 	i2c_unregister_device(max8997->muic);
+err_i2c_muic:
 	i2c_unregister_device(max8997->haptic);
+err_i2c_haptic:
 	i2c_unregister_device(max8997->rtc);
 	return ret;
 }
-- 
1.7.9.5

[PATCH 7/7] mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error

[Krzysztof Kozlowski]

During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.

In case of error (i2c_new_device(): memory allocation failure or I2C
address cannot be used) this function returns NULL which is later used
by i2c_unregister_device().

If i2c_new_dummy() fails for RTC device, fail also the probe for
main MFD driver.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Cc: stable@vger.kernel.org
---
 drivers/mfd/max8998.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
index 612ca404e150..61ea1826f8b4 100644
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -215,6 +215,10 @@ static int max8998_i2c_probe(struct i2c_client *i2c,
 	mutex_init(&max8998->iolock);
 
 	max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
+	if (!max8998->rtc) {
+		dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n");
+		return -ENODEV;
+	}
 	i2c_set_clientdata(max8998->rtc, max8998);
 
 	max8998_irq_init(max8998);
-- 
1.7.9.5

Re: [PATCH 1/7] mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error

[Lee Jones]

On Tue, 11 Feb 2014, Krzysztof Kozlowski wrote:

> During probe the driver allocates dummy I2C device for companion chip
> with i2c_new_dummy() but it does not check the return value of this call.
> 
> In case of error (i2c_new_device(): memory allocation failure or I2C
> address cannot be used) this function returns NULL which is later used
> by regmap_init_i2c().
> 
> If i2c_new_dummy() fails for companion device, fail also the probe for
> main MFD driver.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/mfd/88pm860x-core.c |    5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
> index c9b1f6422941..e456be9a7c67 100644
> --- a/drivers/mfd/88pm860x-core.c
> +++ b/drivers/mfd/88pm860x-core.c
> @@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_client *client,
>  		chip->companion_addr = pdata->companion_addr;
>  		chip->companion = i2c_new_dummy(chip->client->adapter,
>  						chip->companion_addr);
> +		if (!chip->companion) {
> +			dev_err(&client->dev,
> +				"Failed to allocate I2C companion device\n");
> +			return -ENODEV;
> +		}
>  		chip->regmap_companion = regmap_init_i2c(chip->companion,
>  							&pm860x_regmap_config);
>  		if (IS_ERR(chip->regmap_companion)) {

Applied, thanks.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 2/7] mfd: 88pm860x: Fix I2C device resource leak on regmap init fail

[Lee Jones]

On Tue, 11 Feb 2014, Krzysztof Kozlowski wrote:

> During probe the driver allocates dummy I2C device for companion chip
> and then allocates a regmap for it. If regmap_init_i2c() fails then the
> I2C driver (allocated with i2c_new_dummy()) is not freed and this
> resource leaks.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/mfd/88pm860x-core.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/mfd/88pm860x-core.c b/drivers/mfd/88pm860x-core.c
> index e456be9a7c67..bcfc9e85b4a0 100644
> --- a/drivers/mfd/88pm860x-core.c
> +++ b/drivers/mfd/88pm860x-core.c
> @@ -1190,6 +1190,7 @@ static int pm860x_probe(struct i2c_client *client,
>  			ret = PTR_ERR(chip->regmap_companion);
>  			dev_err(&chip->companion->dev,
>  				"Failed to allocate register map: %d\n", ret);
> +			i2c_unregister_device(chip->companion);
>  			return ret;
>  		}
>  		i2c_set_clientdata(chip->companion, chip);

Applied, thanks.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 3/7] mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error

[Lee Jones]

On Tue, 11 Feb 2014, Krzysztof Kozlowski wrote:

> During probe the driver allocates dummy I2C device for RTC with
> i2c_new_dummy() but it does not check the return value of this call.
> 
> In case of error (i2c_new_device(): memory allocation failure or I2C
> address cannot be used) this function returns NULL which is later used
> by i2c_unregister_device().
> 
> If i2c_new_dummy() fails for RTC device, fail also the probe for main
> MFD driver.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/mfd/max77686.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
> index f53d5823a3f7..e5fce765accb 100644
> --- a/drivers/mfd/max77686.c
> +++ b/drivers/mfd/max77686.c
> @@ -121,6 +121,10 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
>  		dev_info(max77686->dev, "device found\n");
>  
>  	max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
> +	if (!max77686->rtc) {
> +		dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n");
> +		return -ENODEV;
> +	}
>  	i2c_set_clientdata(max77686->rtc, max77686);
>  
>  	max77686_irq_init(max77686);

Applied, thanks.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 4/7] mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error

[Lee Jones]

On Tue, 11 Feb 2014, Krzysztof Kozlowski wrote:

> During probe the driver allocates dummy I2C devices for MUIC and haptic
> with i2c_new_dummy() but it does not check the return value of this
> calls.
> 
> In case of error (i2c_new_device(): memory allocation failure or I2C
> address cannot be used) this function returns NULL which is later used
> by devm_regmap_init_i2c() and i2c_unregister_device().
> 
> If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe
> for main MFD driver.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/mfd/max77693.c |   12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
> index e0859987ab6b..c5535f018466 100644
> --- a/drivers/mfd/max77693.c
> +++ b/drivers/mfd/max77693.c
> @@ -148,9 +148,18 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
>  		dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
>  
>  	max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
> +	if (!max77693->muic) {
> +		dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n");
> +		return -ENODEV;
> +	}
>  	i2c_set_clientdata(max77693->muic, max77693);
>  
>  	max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
> +	if (!max77693->haptic) {
> +		dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n");
> +		ret = -ENODEV;
> +		goto err_i2c_haptic;
> +	}
>  	i2c_set_clientdata(max77693->haptic, max77693);
>  
>  	/*
> @@ -184,8 +193,9 @@ err_mfd:
>  	max77693_irq_exit(max77693);
>  err_irq:
>  err_regmap_muic:
> -	i2c_unregister_device(max77693->muic);
>  	i2c_unregister_device(max77693->haptic);
> +err_i2c_haptic:
> +	i2c_unregister_device(max77693->muic);
>  	return ret;
>  }
>  

Applied, thanks.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 5/7] mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error

[Lee Jones]

On Tue, 11 Feb 2014, Krzysztof Kozlowski wrote:

> During probe the driver allocates dummy I2C devices for RTC and ADC
> with i2c_new_dummy() but it does not check the return value of this
> calls.
> 
> In case of error (i2c_new_device(): memory allocation failure or I2C
> address cannot be used) this function returns NULL which is later used
> by i2c_unregister_device().
> 
> If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe
> for main MFD driver.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/mfd/max8925-i2c.c |    9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/mfd/max8925-i2c.c b/drivers/mfd/max8925-i2c.c
> index 176aa26fc787..a83eed5c15ca 100644
> --- a/drivers/mfd/max8925-i2c.c
> +++ b/drivers/mfd/max8925-i2c.c
> @@ -181,9 +181,18 @@ static int max8925_probe(struct i2c_client *client,
>  	mutex_init(&chip->io_lock);
>  
>  	chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR);
> +	if (!chip->rtc) {
> +		dev_err(chip->dev, "Failed to allocate I2C device for RTC\n");
> +		return -ENODEV;
> +	}
>  	i2c_set_clientdata(chip->rtc, chip);
>  
>  	chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR);
> +	if (!chip->adc) {
> +		dev_err(chip->dev, "Failed to allocate I2C device for ADC\n");
> +		i2c_unregister_device(chip->rtc);
> +		return -ENODEV;
> +	}
>  	i2c_set_clientdata(chip->adc, chip);
>  
>  	device_init_wakeup(&client->dev, 1);

Applied, thanks.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 6/7] mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error

[Lee Jones]

On Tue, 11 Feb 2014, Krzysztof Kozlowski wrote:

> During probe the driver allocates dummy I2C devices for RTC, haptic and
> MUIC with i2c_new_dummy() but it does not check the return value of this
> calls.
> 
> In case of error (i2c_new_device(): memory allocation failure or I2C
> address cannot be used) this function returns NULL which is later used
> by i2c_unregister_device().
> 
> If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the
> probe for main MFD driver.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/mfd/max8997.c |   18 ++++++++++++++++++
>  1 file changed, 18 insertions(+)
> 
> diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c
> index be88a3bf7b85..3ffc11dfc3b6 100644
> --- a/drivers/mfd/max8997.c
> +++ b/drivers/mfd/max8997.c
> @@ -208,10 +208,26 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
>  	mutex_init(&max8997->iolock);
>  
>  	max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC);
> +	if (!max8997->rtc) {
> +		dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n");
> +		return -ENODEV;
> +	}
>  	i2c_set_clientdata(max8997->rtc, max8997);
> +
>  	max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC);
> +	if (!max8997->haptic) {
> +		dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n");
> +		ret = -ENODEV;
> +		goto err_i2c_haptic;
> +	}
>  	i2c_set_clientdata(max8997->haptic, max8997);
> +
>  	max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC);
> +	if (!max8997->muic) {
> +		dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n");
> +		ret = -ENODEV;
> +		goto err_i2c_muic;
> +	}
>  	i2c_set_clientdata(max8997->muic, max8997);
>  
>  	pm_runtime_set_active(max8997->dev);
> @@ -239,7 +255,9 @@ static int max8997_i2c_probe(struct i2c_client *i2c,
>  err_mfd:
>  	mfd_remove_devices(max8997->dev);
>  	i2c_unregister_device(max8997->muic);
> +err_i2c_muic:
>  	i2c_unregister_device(max8997->haptic);
> +err_i2c_haptic:
>  	i2c_unregister_device(max8997->rtc);
>  	return ret;
>  }

Applied, thanks.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog

Re: [PATCH 7/7] mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error

[Lee Jones]

On Tue, 11 Feb 2014, Krzysztof Kozlowski wrote:

> During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call.
> 
> In case of error (i2c_new_device(): memory allocation failure or I2C
> address cannot be used) this function returns NULL which is later used
> by i2c_unregister_device().
> 
> If i2c_new_dummy() fails for RTC device, fail also the probe for
> main MFD driver.
> 
> Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/mfd/max8998.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
> index 612ca404e150..61ea1826f8b4 100644
> --- a/drivers/mfd/max8998.c
> +++ b/drivers/mfd/max8998.c
> @@ -215,6 +215,10 @@ static int max8998_i2c_probe(struct i2c_client *i2c,
>  	mutex_init(&max8998->iolock);
>  
>  	max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
> +	if (!max8998->rtc) {
> +		dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n");
> +		return -ENODEV;
> +	}
>  	i2c_set_clientdata(max8998->rtc, max8998);
>  
>  	max8998_irq_init(max8998);

Applied, thanks.

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog