Merge tag 'char-misc-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH: "Here are some small fixes for some misc drivers that resolve some reported issues. All of these have been linux-next for a while" * tag 'char-misc-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: mcb: Fix error handling in mcb_pci_probe() mei: hbm: fix error in state check logic nvmem: sunxi: Check for memory allocation failure nvmem: core: Fix memory leak in nvmem_cell_write nvmem: core: Handle shift bits in-place if cell->nbits is non-zero nvmem: core: fix the out-of-range leak in read/write()

Linus Torvalds committed 11 years ago

Commit ef19df62 parents bbecce8 41ada9d4 files · +19 −8Browse files

Unified · Split

4 files

drivers/mcb/mcb-pci.c +4 −2
drivers/misc/mei/hbm.c +1 −1
drivers/nvmem/core.c +4 −4
drivers/nvmem/sunxi_sid.c +10 −1

drivers/mcb/mcb-pci.c+4−2

@@ -74,7 +74,7 @@ static int mcb_pci_probe(struct pci_dev pdev, const struct pci_device_id id) · 73 unmodified lines
74	74	ret = -ENOTSUPP;
75	75	dev_err(&pdev->dev,
76	76	"IO mapped PCI devices are not supported\n");
77		− goto out_release;
	77	+ goto out_iounmap;
78	78	}
79	79
80	80	pci_set_drvdata(pdev, priv);
@@ -89,7 +89,7 @@ static int mcb_pci_probe(struct pci_dev pdev, const struct pci_device_id id) · 8 unmodified lines
89	89
90	90	ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base);
91	91	if (ret < 0)
92		− goto out_iounmap;
	92	+ goto out_mcb_bus;
93	93	num_cells = ret;
94	94
95	95	dev_dbg(&pdev->dev, "Found %d cells\n", num_cells);
@@ -98,6 +98,8 @@ static int mcb_pci_probe(struct pci_dev pdev, const struct pci_device_id id) · 2 unmodified lines
98	98
99	99	return 0;
100	100
	101	+out_mcb_bus:
	102	+ mcb_release_bus(priv->bus);
101	103	out_iounmap:
102	104	iounmap(priv->base);
103	105	out_release:

drivers/misc/mei/hbm.c+1−1

@@ -1209,7 +1209,7 @@ int mei_hbm_dispatch(struct mei_device dev, struct mei_msg_hdr hdr) · 1208 unmodified lines
1209	1209	* after the host receives the enum_resp
1210	1210	* message clients may be added or removed
1211	1211	*/
1212		− if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS &&
	1212	+ if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS \|\|
1213	1213	dev->hbm_state >= MEI_HBM_STOPPED) {
1214	1214	dev_err(dev->dev, "hbm: add client: state mismatch, [%d, %d]\n",
1215	1215	dev->dev_state, dev->hbm_state);

drivers/nvmem/core.c+4−4

@@ -67,7 +67,7 @@ static ssize_t bin_attr_nvmem_read(struct file filp, struct kobject kobj, · 66 unmodified lines
67	67	int rc;
68	68
69	69	/* Stop the user from reading */
70		− if (pos > nvmem->size)
	70	+ if (pos >= nvmem->size)
71	71	return 0;
72	72
73	73	if (pos + count > nvmem->size)
@@ -92,7 +92,7 @@ static ssize_t bin_attr_nvmem_write(struct file filp, struct kobject kobj, · 18 unmodified lines
92	92	int rc;
93	93
94	94	/* Stop the user from writing */
95		− if (pos > nvmem->size)
	95	+ if (pos >= nvmem->size)
96	96	return 0;
97	97
98	98	if (pos + count > nvmem->size)
@@ -825,7 +825,7 @@ static int __nvmem_cell_read(struct nvmem_device *nvmem, · 726 unmodified lines
825	825	return rc;
826	826
827	827	/* shift bits in-place */
828		− if (cell->bit_offset \|\| cell->bit_offset)
	828	+ if (cell->bit_offset \|\| cell->nbits)
829	829	nvmem_shift_read_buffer_in_place(cell, buf);
830	830
831	831	*len = cell->bytes;
@@ -938,7 +938,7 @@ int nvmem_cell_write(struct nvmem_cell cell, void buf, size_t len) · 106 unmodified lines
938	938	rc = regmap_raw_write(nvmem->regmap, cell->offset, buf, cell->bytes);
939	939
940	940	/* free the tmp buffer */
941		− if (cell->bit_offset)
	941	+ if (cell->bit_offset \|\| cell->nbits)
942	942	kfree(buf);
943	943
944	944	if (IS_ERR_VALUE(rc))

drivers/nvmem/sunxi_sid.c+10−1

@@ -103,7 +103,7 @@ static int sunxi_sid_probe(struct platform_device *pdev) · 102 unmodified lines
103	103	struct nvmem_device *nvmem;
104	104	struct regmap *regmap;
105	105	struct sunxi_sid *sid;
106		− int i, size;
	106	+ int ret, i, size;
107	107	char *randomness;
108	108
109	109	sid = devm_kzalloc(dev, sizeof(*sid), GFP_KERNEL);
@@ -131,6 +131,11 @@ static int sunxi_sid_probe(struct platform_device *pdev) · 21 unmodified lines
131	131	return PTR_ERR(nvmem);
132	132
133	133	randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL);
	134	+ if (!randomness) {
	135	+ ret = -EINVAL;
	136	+ goto err_unreg_nvmem;
	137	+ }
	138	+
134	139	for (i = 0; i < size; i++)
135	140	randomness[i] = sunxi_sid_read_byte(sid, i);
136	141
@@ -140,6 +145,10 @@ static int sunxi_sid_probe(struct platform_device *pdev) · 3 unmodified lines
140	145	platform_set_drvdata(pdev, nvmem);
141	146
142	147	return 0;
	148	+
	149	+err_unreg_nvmem:
	150	+ nvmem_unregister(nvmem);
	151	+ return ret;
143	152	}
144	153
145	154	static int sunxi_sid_remove(struct platform_device *pdev)