]> git.karo-electronics.de Git - karo-tx-linux.git/commit
mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail
authorKrzysztof Kozlowski <k.kozlowski@samsung.com>
Wed, 12 Mar 2014 15:50:44 +0000 (16:50 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 6 May 2014 14:59:25 +0000 (07:59 -0700)
commit9ae64846e73d519426778a0cad99b17d2a8a38c9
tree95ad4ca7b70083b5724de557710519de24070c79
parent209c4f31f9f6b8521b81ea9bd4558835ac75a99c
mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail

commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream.

Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file")
tps65910_irq_init() sets 'tps65910->chip_irq' before calling
regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
memory allocation of regmap_irq_chip_data members then:

1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory
   (because regmap_add_irq_chip() will free it on error)

This results in invalid memory access during driver remove because the
tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/mfd/tps65910.c