[patch] viafb: NULL dereference on allocation failure in query_edid()

Subsystems: framebuffer layer, the rest

STALE5294d

2 messages, 2 authors, 2012-02-17 · open the first message on its own page

[patch] viafb: NULL dereference on allocation failure in query_edid()

From: Dan Carpenter <hidden>
Date: 2012-02-17 06:45:01

We should handle the allocation here, if only to keep the static
checkers happy.

Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/video/via/via_aux_edid.c b/drivers/video/via/via_aux_edid.c
index 03f7a41..754d450 100644
--- a/drivers/video/via/via_aux_edid.c
+++ b/drivers/video/via/via_aux_edid.c

@@ -36,10 +36,13 @@ static void query_edid(struct via_aux_drv *drv)
 	unsigned char edid[EDID_LENGTH];
 	bool valid = false;
 
-	if (spec)
+	if (spec) {
 		fb_destroy_modedb(spec->modedb);
-	else
+	} else {
 		spec = kmalloc(sizeof(*spec), GFP_KERNEL);
+		if (!spec)
+			return;
+	}
 
 	spec->version = spec->revision = 0;
 	if (via_aux_read(drv, 0x00, edid, EDID_LENGTH)) {

Re: [patch] viafb: NULL dereference on allocation failure in query_edid()

From: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Date: 2012-02-17 07:30:07

On 02/17/2012 06:45 AM, Dan Carpenter wrote:

We should handle the allocation here, if only to keep the static
checkers happy.

Signed-off-by: Dan Carpenter <redacted>

Ah, thanks for noticing it and sorry that I introduced it in the first place.
Applied.


Thanks,

Florian Tobias Schandinat

quoted hunk

diff --git a/drivers/video/via/via_aux_edid.c b/drivers/video/via/via_aux_edid.c
index 03f7a41..754d450 100644
--- a/drivers/video/via/via_aux_edid.c
+++ b/drivers/video/via/via_aux_edid.c

@@ -36,10 +36,13 @@ static void query_edid(struct via_aux_drv *drv)
 	unsigned char edid[EDID_LENGTH];
 	bool valid = false;
 
-	if (spec)
+	if (spec) {
 		fb_destroy_modedb(spec->modedb);
-	else
+	} else {
 		spec = kmalloc(sizeof(*spec), GFP_KERNEL);
+		if (!spec)
+			return;
+	}
 
 	spec->version = spec->revision = 0;
 	if (via_aux_read(drv, 0x00, edid, EDID_LENGTH)) {

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help