History

Merge tag 'char-misc-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH: "Here are some small fixes for some misc drivers that resolve some reported issues. All of these have been linux-next for a while" * tag 'char-misc-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: mcb: Fix error handling in mcb_pci_probe() mei: hbm: fix error in state check logic nvmem: sunxi: Check for memory allocation failure nvmem: core: Fix memory leak in nvmem_cell_write nvmem: core: Handle shift bits in-place if cell->nbits is non-zero nvmem: core: fix the out-of-range leak in read/write()

Linus Torvalds committed 11 years ago

Commit ef19df62 parents bbecce8 41ada9d4 files · +19 −8Browse files

Unified · Split

4 files
  1. drivers/mcb/mcb-pci.c +4 −2
  2. drivers/misc/mei/hbm.c +1 −1
  3. drivers/nvmem/core.c +4 −4
  4. drivers/nvmem/sunxi_sid.c +10 −1
drivers/mcb/mcb-pci.c+4−2
@@ -74,7 +74,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) · 73 unmodified lines
74 ret = -ENOTSUPP;74 ret = -ENOTSUPP;
75 dev_err(&pdev->dev,75 dev_err(&pdev->dev,
76 "IO mapped PCI devices are not supported\n");76 "IO mapped PCI devices are not supported\n");
77 goto out_release;77 goto out_iounmap;
78 }78 }
79 79
80 pci_set_drvdata(pdev, priv);80 pci_set_drvdata(pdev, priv);
@@ -89,7 +89,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) · 8 unmodified lines
89 89
90 ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base);90 ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base);
91 if (ret < 0)91 if (ret < 0)
92 goto out_iounmap;92 goto out_mcb_bus;
93 num_cells = ret;93 num_cells = ret;
94 94
95 dev_dbg(&pdev->dev, "Found %d cells\n", num_cells);95 dev_dbg(&pdev->dev, "Found %d cells\n", num_cells);
@@ -98,6 +98,8 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) · 2 unmodified lines
98 98
99 return 0;99 return 0;
100 100
101out_mcb_bus:
102 mcb_release_bus(priv->bus);
101out_iounmap:103out_iounmap:
102 iounmap(priv->base);104 iounmap(priv->base);
103out_release:105out_release:
drivers/misc/mei/hbm.c+1−1
@@ -1209,7 +1209,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr) · 1208 unmodified lines
1209 * after the host receives the enum_resp1209 * after the host receives the enum_resp
1210 * message clients may be added or removed1210 * message clients may be added or removed
1211 */1211 */
1212 if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS &&1212 if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS ||
1213 dev->hbm_state >= MEI_HBM_STOPPED) {1213 dev->hbm_state >= MEI_HBM_STOPPED) {
1214 dev_err(dev->dev, "hbm: add client: state mismatch, [%d, %d]\n",1214 dev_err(dev->dev, "hbm: add client: state mismatch, [%d, %d]\n",
1215 dev->dev_state, dev->hbm_state);1215 dev->dev_state, dev->hbm_state);
drivers/nvmem/core.c+4−4
@@ -67,7 +67,7 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj, · 66 unmodified lines
67 int rc;67 int rc;
68 68
69 /* Stop the user from reading */69 /* Stop the user from reading */
70 if (pos > nvmem->size)70 if (pos >= nvmem->size)
71 return 0;71 return 0;
72 72
73 if (pos + count > nvmem->size)73 if (pos + count > nvmem->size)
@@ -92,7 +92,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj, · 18 unmodified lines
92 int rc;92 int rc;
93 93
94 /* Stop the user from writing */94 /* Stop the user from writing */
95 if (pos > nvmem->size)95 if (pos >= nvmem->size)
96 return 0;96 return 0;
97 97
98 if (pos + count > nvmem->size)98 if (pos + count > nvmem->size)
@@ -825,7 +825,7 @@ static int __nvmem_cell_read(struct nvmem_device *nvmem, · 726 unmodified lines
825 return rc;825 return rc;
826 826
827 /* shift bits in-place */827 /* shift bits in-place */
828 if (cell->bit_offset || cell->bit_offset)828 if (cell->bit_offset || cell->nbits)
829 nvmem_shift_read_buffer_in_place(cell, buf);829 nvmem_shift_read_buffer_in_place(cell, buf);
830 830
831 *len = cell->bytes;831 *len = cell->bytes;
@@ -938,7 +938,7 @@ int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len) · 106 unmodified lines
938 rc = regmap_raw_write(nvmem->regmap, cell->offset, buf, cell->bytes);938 rc = regmap_raw_write(nvmem->regmap, cell->offset, buf, cell->bytes);
939 939
940 /* free the tmp buffer */940 /* free the tmp buffer */
941 if (cell->bit_offset)941 if (cell->bit_offset || cell->nbits)
942 kfree(buf);942 kfree(buf);
943 943
944 if (IS_ERR_VALUE(rc))944 if (IS_ERR_VALUE(rc))
drivers/nvmem/sunxi_sid.c+10−1
@@ -103,7 +103,7 @@ static int sunxi_sid_probe(struct platform_device *pdev) · 102 unmodified lines
103 struct nvmem_device *nvmem;103 struct nvmem_device *nvmem;
104 struct regmap *regmap;104 struct regmap *regmap;
105 struct sunxi_sid *sid;105 struct sunxi_sid *sid;
106 int i, size;106 int ret, i, size;
107 char *randomness;107 char *randomness;
108 108
109 sid = devm_kzalloc(dev, sizeof(*sid), GFP_KERNEL);109 sid = devm_kzalloc(dev, sizeof(*sid), GFP_KERNEL);
@@ -131,6 +131,11 @@ static int sunxi_sid_probe(struct platform_device *pdev) · 21 unmodified lines
131 return PTR_ERR(nvmem);131 return PTR_ERR(nvmem);
132 132
133 randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL);133 randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL);
134 if (!randomness) {
135 ret = -EINVAL;
136 goto err_unreg_nvmem;
137 }
138
134 for (i = 0; i < size; i++)139 for (i = 0; i < size; i++)
135 randomness[i] = sunxi_sid_read_byte(sid, i);140 randomness[i] = sunxi_sid_read_byte(sid, i);
136 141
@@ -140,6 +145,10 @@ static int sunxi_sid_probe(struct platform_device *pdev) · 3 unmodified lines
140 platform_set_drvdata(pdev, nvmem);145 platform_set_drvdata(pdev, nvmem);
141 146
142 return 0;147 return 0;
148
149err_unreg_nvmem:
150 nvmem_unregister(nvmem);
151 return ret;
143}152}
144 153
145static int sunxi_sid_remove(struct platform_device *pdev)154static int sunxi_sid_remove(struct platform_device *pdev)