diff options
| author | Krzysztof Kozlowski <k.kozlowski@samsung.com> | 2014-03-12 16:50:44 +0100 |
|---|---|---|
| committer | Lee Jones <lee.jones@linaro.org> | 2014-03-19 09:04:44 +0000 |
| commit | 483e2dfdbc94751430e41db9973985f5b054d322 (patch) | |
| tree | 7de197c5e7cf75716bca782860a5327cf663c06f /lib/flex_proportions.c | |
| parent | 8c66eeced1989c98104783832ab445305fa8c7a3 (diff) | |
mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail
Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file")
tps65910_irq_init() sets 'tps65910->chip_irq' before calling
regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in
memory allocation of regmap_irq_chip_data members then:
1. The 'tps65910->chip_irq' will still hold some value
2. 'tps65910->irq_data' will be pointing to already freed memory
(because regmap_add_irq_chip() will free it on error)
This results in invalid memory access during driver remove because the
tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero.
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Diffstat (limited to 'lib/flex_proportions.c')
0 files changed, 0 insertions, 0 deletions