diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-10-19 13:20:05 +0300 |
|---|---|---|
| committer | Brian Norris <computersforpeace@gmail.com> | 2015-10-26 11:45:30 -0700 |
| commit | 2382960793c2480277ae98a891ea5aa566e06ff1 (patch) | |
| tree | 6ef6e74ad19631e7ba00bd1f2651446343e3967b /drivers/mtd/devices/docg3.c | |
| parent | 89c1702da717164fcff633594e130f54dd563499 (diff) | |
mtd: docg3: off by one in doc_register_sysfs()
Smatch found a bug in the error handling:
drivers/mtd/devices/docg3.c:1634 doc_register_sysfs()
error: buffer overflow 'doc_sys_attrs' 4 <= 4
The problem is that if the very last device_create_file() fails, then we
are beyond the end of the array. Actually, any time i == 3 then there
is a problem. We can fix this an simplify the code at the same time by
moving the !ret conditions out of the for loops and using a goto
instead.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Diffstat (limited to 'drivers/mtd/devices/docg3.c')
| -rw-r--r-- | drivers/mtd/devices/docg3.c | 22 |
1 files changed, 16 insertions, 6 deletions
diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c index f00d0dae917f..c3a2695a4420 100644 --- a/drivers/mtd/devices/docg3.c +++ b/drivers/mtd/devices/docg3.c @@ -1620,20 +1620,30 @@ static struct device_attribute doc_sys_attrs[DOC_MAX_NBFLOORS][4] = { static int doc_register_sysfs(struct platform_device *pdev, struct docg3_cascade *cascade) { - int ret = 0, floor, i = 0; struct device *dev = &pdev->dev; + int floor; + int ret; + int i; - for (floor = 0; !ret && floor < DOC_MAX_NBFLOORS && - cascade->floors[floor]; floor++) - for (i = 0; !ret && i < 4; i++) + for (floor = 0; + floor < DOC_MAX_NBFLOORS && cascade->floors[floor]; + floor++) { + for (i = 0; i < 4; i++) { ret = device_create_file(dev, &doc_sys_attrs[floor][i]); - if (!ret) - return 0; + if (ret) + goto remove_files; + } + } + + return 0; + +remove_files: do { while (--i >= 0) device_remove_file(dev, &doc_sys_attrs[floor][i]); i = 4; } while (--floor >= 0); + return ret; } |