The patch titled mtd: physmap: fix NULL pointer dereference in error path has been added to the -mm tree. Its filename is mtd-physmap-fix-null-pointer-dereference-in-error-path.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: mtd: physmap: fix NULL pointer dereference in error path From: Atsushi Nemoto <anemo@xxxxxxxxxxxxx> commit e480814f138cd5d78a8efe397756ba6b6518fdb6 ("[MTD] [MAPS] physmap: fix wrong free and del_mtd_{partition,device}") introduces a NULL pointer dereference in physmap_flash_remove when called from the error path in physmap_flash_probe (if map_probe failed). Call del_mtd_{partition,device} only if info->cmtd was not NULL. Reported-by: pHilipp Zabel <philipp.zabel@xxxxxxxxx> Signed-off-by: Atsushi Nemoto <anemo@xxxxxxxxxxxxx> Cc: David Woodhouse <dwmw2@xxxxxxxxxxxxx> Cc: "Rafael J. Wysocki" <rjw@xxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/mtd/maps/physmap.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff -puN drivers/mtd/maps/physmap.c~mtd-physmap-fix-null-pointer-dereference-in-error-path drivers/mtd/maps/physmap.c --- a/drivers/mtd/maps/physmap.c~mtd-physmap-fix-null-pointer-dereference-in-error-path +++ a/drivers/mtd/maps/physmap.c @@ -46,16 +46,19 @@ static int physmap_flash_remove(struct p physmap_data = dev->dev.platform_data; + if (info->cmtd) { #ifdef CONFIG_MTD_PARTITIONS - if (info->nr_parts) { - del_mtd_partitions(info->cmtd); - kfree(info->parts); - } else if (physmap_data->nr_parts) - del_mtd_partitions(info->cmtd); - else - del_mtd_device(info->cmtd); + if (info->nr_parts || physmap_data->nr_parts) + del_mtd_partitions(info->cmtd); + else + del_mtd_device(info->cmtd); #else - del_mtd_device(info->cmtd); + del_mtd_device(info->cmtd); +#endif + } +#ifdef CONFIG_MTD_PARTITIONS + if (info->nr_parts) + kfree(info->parts); #endif #ifdef CONFIG_MTD_CONCAT _ Patches currently in -mm which might be from anemo@xxxxxxxxxxxxx are mtd-txx9-add-ndfmc-support.patch mtd-rbtx4939-add-mtd-support.patch mtd-txx9-soc-nand-flash-memory-controller-driver.patch mtd-rbtx4939-map-driver-v2.patch mtd-physmap-fix-null-pointer-dereference-in-error-path.patch kgdb-kgdboc-console-poll-hooks-for-serial_txx9-uart.patch serial_txx9-use-container_of-instead-of-direct-cast.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html