[patch] video: fbdev: pxafb: potential NULL dereference on error

[patch] video: fbdev: pxafb: potential NULL dereference on error

[Dan Carpenter]

If we "goto out;" then it calls display_timings_release(timings);
Since "timings" is NULL, that's going to oops.  Just return directly.

Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
index 2c0487f..ed41fdb 100644
--- a/drivers/video/fbdev/pxafb.c
+++ b/drivers/video/fbdev/pxafb.c
@@ -2125,7 +2125,7 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
 
 	timings = of_get_display_timings(disp);
 	if (!timings)
-		goto out;
+		return -EINVAL;
 
 	ret = -ENOMEM;
 	info->modes = kmalloc_array(timings->num_timings,

Re: [patch] video: fbdev: pxafb: potential NULL dereference on error

[Robert Jarzmik]

Dan Carpenter <dan.carpenter@oracle.com> writes:

> If we "goto out;" then it calls display_timings_release(timings);
> Since "timings" is NULL, that's going to oops.  Just return directly.
>
> Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>

Cheers.

--
Robert

Re: [patch] video: fbdev: pxafb: potential NULL dereference on error

[Tomi Valkeinen]

[-- Attachment #1.1: Type: text/plain, Size: 844 bytes --]


On 15/07/16 14:07, Dan Carpenter wrote:
> If we "goto out;" then it calls display_timings_release(timings);
> Since "timings" is NULL, that's going to oops.  Just return directly.
> 
> Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
> index 2c0487f..ed41fdb 100644
> --- a/drivers/video/fbdev/pxafb.c
> +++ b/drivers/video/fbdev/pxafb.c
> @@ -2125,7 +2125,7 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
>  
>  	timings = of_get_display_timings(disp);
>  	if (!timings)
> -		goto out;
> +		return -EINVAL;
>  
>  	ret = -ENOMEM;
>  	info->modes = kmalloc_array(timings->num_timings,
> 

Thanks, queued for v4.9.

 Tomi


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]