video: fbdev: pxafb: potential NULL dereference on error

Started by Dan Carpenter on Jul 15, 2016 · 2 messages from 2 authors · Last reply Aug 10, 2016

Subsystems (2)

Maintainers (2)

STALE3742d

open the first message on its own page

Message details and related content
If we "goto out;" then it calls display_timings_release(timings);
Since "timings" is NULL, that's going to oops.  Just return directly.

Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
Signed-off-by: Dan Carpenter <redacted>
diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
index 2c0487f..ed41fdb 100644
--- a/drivers/video/fbdev/pxafb.c
+++ b/drivers/video/fbdev/pxafb.c
@@ -2125,7 +2125,7 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
 
 	timings = of_get_display_timings(disp);
 	if (!timings)
-		goto out;
+		return -EINVAL;
 
 	ret = -ENOMEM;
 	info->modes = kmalloc_array(timings->num_timings,
Message details and related content
On 15/07/16 14:07, Dan Carpenter wrote:
quoted hunk
If we "goto out;" then it calls display_timings_release(timings);
Since "timings" is NULL, that's going to oops.  Just return directly.

Fixes: 420a488278e8 ('video: fbdev: pxafb: initial devicetree conversion')
Signed-off-by: Dan Carpenter <redacted>
diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c
index 2c0487f..ed41fdb 100644
--- a/drivers/video/fbdev/pxafb.c
+++ b/drivers/video/fbdev/pxafb.c
@@ -2125,7 +2125,7 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp,
 
 	timings = of_get_display_timings(disp);
 	if (!timings)
-		goto out;
+		return -EINVAL;
 
 	ret = -ENOMEM;
 	info->modes = kmalloc_array(timings->num_timings,
Thanks, queued for v4.9.

 Tomi
Keyboard shortcuts
hback out one level
jnext message in thread / next series-diff position
kprevious message in thread / previous series-diff position
ldrill in
Escclose help / fold thread tree
?toggle this help