mtd: docg3: dereferencing an ERR_PTR() in docg3_probe()

If doc_probe_device() returned an ERR_PTR, then we accidentally saved
that to docg3_floors[floor] = mtd; which gets derefenced in the error
handling when we call doc_release_device().

I've reworked the error handling to take care of that and hopefully
make it a little simpler.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index d7df3114aa1718d8124903f478b04a7270bc90f8..f7490a014e78159b5f1964803c8ce608fec09aba 100644 (file)
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -2027,21 +2027,24 @@ static int __init docg3_probe(struct platform_device *pdev)
        if (!docg3_bch)
                goto nomem2;
 
-       ret = 0;
        for (floor = 0; floor < DOC_MAX_NBFLOORS; floor++) {
                mtd = doc_probe_device(base, floor, dev);
-               if (floor == 0 && !mtd)
-                       goto notfound;
-               if (!IS_ERR_OR_NULL(mtd))
-                       ret = mtd_device_parse_register(mtd, part_probes,
-                                                       NULL, NULL, 0);
-               else
+               if (IS_ERR(mtd)) {
                        ret = PTR_ERR(mtd);
+                       goto err_probe;
+               }
+               if (!mtd) {
+                       if (floor == 0)
+                               goto notfound;
+                       else
+                               continue;
+               }
                docg3_floors[floor] = mtd;
+               ret = mtd_device_parse_register(mtd, part_probes, NULL, NULL,
+                                               0);
                if (ret)
                        goto err_probe;
-               if (mtd)
-                       found++;
+               found++;
        }
 
        ret = doc_register_sysfs(pdev, docg3_floors);