releases/3.14.3/mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch

   1 From 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb Mon Sep 17 00:00:00 2001
   2 From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
   3 Date: Tue, 11 Feb 2014 11:03:29 +0100
   4 Subject: mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error
   5
   6 From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
   7
   8 commit 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb upstream.
   9
  10 During probe the driver allocates dummy I2C device for companion chip
  11 with i2c_new_dummy() but it does not check the return value of this call.
  12
  13 In case of error (i2c_new_device(): memory allocation failure or I2C
  14 address cannot be used) this function returns NULL which is later used
  15 by regmap_init_i2c().
  16
  17 If i2c_new_dummy() fails for companion device, fail also the probe for
  18 main MFD driver.
  19
  20 Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
  21 Signed-off-by: Lee Jones <lee.jones@linaro.org>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  drivers/mfd/88pm860x-core.c |    5 +++++
  26  1 file changed, 5 insertions(+)
  27
  28 --- a/drivers/mfd/88pm860x-core.c
  29 +++ b/drivers/mfd/88pm860x-core.c
  30 @@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_clien
  31                 chip->companion_addr = pdata->companion_addr;
  32                 chip->companion = i2c_new_dummy(chip->client->adapter,
  33                                                 chip->companion_addr);
  34 +               if (!chip->companion) {
  35 +                       dev_err(&client->dev,
  36 +                               "Failed to allocate I2C companion device\n");
  37 +                       return -ENODEV;
  38 +               }
  39                 chip->regmap_companion = regmap_init_i2c(chip->companion,
  40                                                         &pm860x_regmap_config);
  41                 if (IS_ERR(chip->regmap_companion)) {