diff options
| author | Stanislav Fomichev <kernel@fomichev.me> | 2011-02-07 23:48:25 +0300 |
|---|---|---|
| committer | David Woodhouse <David.Woodhouse@intel.com> | 2011-03-11 14:22:44 +0000 |
| commit | 7912a5e7f37512d8d105785046137435b70347ce (patch) | |
| tree | fe093be85b47e494a5ce4c078cc6bd502d1fd949 /drivers/mtd | |
| parent | 7b7e905ec2ec511e06279181ca95a892db21e292 (diff) | |
mtd: nand: fix pointer NULL pointer dereferencing
In 'verify_bbt_descr()', first check the "bd" pointer, then
dereference it.
Comments amended by Artem.
Signed-off-by: Stanislav Fomichev <kernel@fomichev.me>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/nand/nand_bbt.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/mtd/nand/nand_bbt.c b/drivers/mtd/nand/nand_bbt.c index 6ebd869993a..a1e8b30078d 100644 --- a/drivers/mtd/nand/nand_bbt.c +++ b/drivers/mtd/nand/nand_bbt.c @@ -1101,12 +1101,16 @@ static void mark_bbt_region(struct mtd_info *mtd, struct nand_bbt_descr *td) static void verify_bbt_descr(struct mtd_info *mtd, struct nand_bbt_descr *bd) { struct nand_chip *this = mtd->priv; - u32 pattern_len = bd->len; - u32 bits = bd->options & NAND_BBT_NRBITS_MSK; + u32 pattern_len; + u32 bits; u32 table_size; if (!bd) return; + + pattern_len = bd->len; + bits = bd->options & NAND_BBT_NRBITS_MSK; + BUG_ON((this->options & NAND_USE_FLASH_BBT_NO_OOB) && !(this->options & NAND_USE_FLASH_BBT)); BUG_ON(!bits); |