mtd: physmap: fix NULL pointer dereference in error path

commit e480814f138cd5d78a8efe397756ba6b6518fdb6 ("[MTD] [MAPS] physmap:
fix wrong free and del_mtd_{partition,device}") introduces a NULL pointer
dereference in physmap_flash_remove when called from the error path in
physmap_flash_probe (if map_probe failed).

Call del_mtd_{partition,device} only if info->cmtd was not NULL.

Reported-by: pHilipp Zabel <philipp.zabel@gmail.com>
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 4b122e7ab4b3a5efb36071359137e0a2637c80df..229718222db710e27fc980fb68ca287d9553e99d 100644 (file)
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -46,16 +46,19 @@ static int physmap_flash_remove(struct platform_device *dev)
 
        physmap_data = dev->dev.platform_data;
 
+       if (info->cmtd) {
 #ifdef CONFIG_MTD_PARTITIONS
-       if (info->nr_parts) {
-               del_mtd_partitions(info->cmtd);
-               kfree(info->parts);
-       } else if (physmap_data->nr_parts)
-               del_mtd_partitions(info->cmtd);
-       else
-               del_mtd_device(info->cmtd);
+               if (info->nr_parts || physmap_data->nr_parts)
+                       del_mtd_partitions(info->cmtd);
+               else
+                       del_mtd_device(info->cmtd);
 #else
-       del_mtd_device(info->cmtd);
+               del_mtd_device(info->cmtd);
+#endif
+       }
+#ifdef CONFIG_MTD_PARTITIONS
+       if (info->nr_parts)
+               kfree(info->parts);
 #endif
 
 #ifdef CONFIG_MTD_CONCAT