@@ -208,6 +208,7 @@ static int gpio_flash_probe(struct platform_device *pdev)
struct resource *memory;
struct resource *gpios;
struct async_state *state;
+ int ret;
pdata = dev_get_platdata(&pdev->dev);
memory = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -242,6 +243,11 @@ static int gpio_flash_probe(struct platform_device *pdev)
state->map.phys = NO_XIP;
state->map.map_priv_1 = (unsigned long)state;
+ if (!state->map.virt) {
+ ret = -ENODEV;
+ goto err_ioremap;
+ }
+
platform_set_drvdata(pdev, state);
i = 0;
@@ -251,8 +257,8 @@ static int gpio_flash_probe(struct platform_device *pdev)
state->gpio_addrs[i]);
while (i--)
gpio_free(state->gpio_addrs[i]);
- kfree(state);
- return -EBUSY;
+ ret = -EBUSY;
+ goto err_gpio;
}
gpio_direction_output(state->gpio_addrs[i], 0);
} while (++i < state->gpio_count);
@@ -261,28 +267,41 @@ static int gpio_flash_probe(struct platform_device *pdev)
state->map.bankwidth * 8);
state->mtd = do_map_probe(memory->name, &state->map);
if (!state->mtd) {
- for (i = 0; i < state->gpio_count; ++i)
- gpio_free(state->gpio_addrs[i]);
- kfree(state);
- return -ENXIO;
+ ret = -ENXIO;
+ goto err_mtdmap;
}
- mtd_device_parse_register(state->mtd, part_probe_types, NULL,
- pdata->parts, pdata->nr_parts);
+ ret = mtd_device_parse_register(state->mtd, part_probe_types, NULL,
+ pdata->parts, pdata->nr_parts);
+ if (ret)
+ goto err_mtdreg;
return 0;
+
+err_mtdreg:
+ map_destroy(state->mtd);
+err_mtdmap:
+ for (i = 0; i < state->gpio_count; ++i)
+ gpio_free(state->gpio_addrs[i]);
+err_gpio:
+ iounmap(state->map.virt);
+err_ioremap:
+ kfree(state);
+ return ret;
}
static int gpio_flash_remove(struct platform_device *pdev)
{
struct async_state *state = platform_get_drvdata(pdev);
size_t i = 0;
+
do {
gpio_free(state->gpio_addrs[i]);
} while (++i < state->gpio_count);
mtd_device_unregister(state->mtd);
map_destroy(state->mtd);
+ iounmap(state->map.virt);
kfree(state);
return 0;
}
There is no iounmap(state->map.virt) in gpio_flash_remove() and in gpio_flash_probe() error handling code. By the way the patch adds checks for error code of ioremap() and mtd_device_parse_register(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> --- drivers/mtd/maps/gpio-addr-flash.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-)