viafb: NULL dereference on allocation failure in query_edid()

Started by Dan Carpenter on Feb 17, 2012 · 2 messages from 2 authors · Last reply Feb 17, 2012

Subsystems (2)

Maintainers (2)

STALE5383d

open the first message on its own page

Dan Carpenter

Message details and related content
Open message details and related content
We should handle the allocation here, if only to keep the static
checkers happy.

Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/video/via/via_aux_edid.c b/drivers/video/via/via_aux_edid.c
index 03f7a41..754d450 100644
--- a/drivers/video/via/via_aux_edid.c
+++ b/drivers/video/via/via_aux_edid.c
@@ -36,10 +36,13 @@ static void query_edid(struct via_aux_drv *drv)
 	unsigned char edid[EDID_LENGTH];
 	bool valid = false;
 
-	if (spec)
+	if (spec) {
 		fb_destroy_modedb(spec->modedb);
-	else
+	} else {
 		spec = kmalloc(sizeof(*spec), GFP_KERNEL);
+		if (!spec)
+			return;
+	}
 
 	spec->version = spec->revision = 0;
 	if (via_aux_read(drv, 0x00, edid, EDID_LENGTH)) {

Florian Tobias Schandinat replied to Dan Carpenter

Message details and related content
Open message details and related content
On 02/17/2012 06:45 AM, Dan Carpenter wrote:
We should handle the allocation here, if only to keep the static
checkers happy.

Signed-off-by: Dan Carpenter <redacted>
Ah, thanks for noticing it and sorry that I introduced it in the first place.
Applied.


Thanks,

Florian Tobias Schandinat
quoted hunk
diff --git a/drivers/video/via/via_aux_edid.c b/drivers/video/via/via_aux_edid.c
index 03f7a41..754d450 100644
--- a/drivers/video/via/via_aux_edid.c
+++ b/drivers/video/via/via_aux_edid.c
@@ -36,10 +36,13 @@ static void query_edid(struct via_aux_drv *drv)
 	unsigned char edid[EDID_LENGTH];
 	bool valid = false;
 
-	if (spec)
+	if (spec) {
 		fb_destroy_modedb(spec->modedb);
-	else
+	} else {
 		spec = kmalloc(sizeof(*spec), GFP_KERNEL);
+		if (!spec)
+			return;
+	}
 
 	spec->version = spec->revision = 0;
 	if (via_aux_read(drv, 0x00, edid, EDID_LENGTH)) {






    
  

  
    

      

        Keyboard shortcuts
      

      

        
          
hback out one level

          
jnext message in thread / next series-diff position

          
kprevious message in thread / previous series-diff position

          
ldrill in

          
Escclose help / fold thread tree

          
?toggle this help