diff options
| author | Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> | 2015-03-18 00:21:32 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-04-13 14:03:01 +0200 |
| commit | 7dc9ca26d28f7aa4f58db7e0b824ea01a3009ff1 (patch) | |
| tree | 4975817f846fd8f488ed2be482015801b6917c57 /drivers/of | |
| parent | 9e8da08d94891046fe64fc4c8f4c091549975e74 (diff) | |
| download | lwn-7dc9ca26d28f7aa4f58db7e0b824ea01a3009ff1.tar.gz lwn-7dc9ca26d28f7aa4f58db7e0b824ea01a3009ff1.zip | |
of/irq: Fix of_irq_parse_one() returned error codes
commit d7c146053dd195b90c79b9b8131431f44541d015 upstream.
The error code paths that require cleanup use a goto to jump to the
cleanup code and return an error code. However, the error code variable
res, which is initialized to -EINVAL when declared, is then overwritten
with the return value of of_parse_phandle_with_args(), and reused as the
return code from of_irq_parse_one(). This leads to an undetermined error
being returned instead of the expected -EINVAL value. Fix it.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/of')
| -rw-r--r-- | drivers/of/irq.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 48f20ff1add9..bbff99dcbaea 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar struct device_node *p; const __be32 *intspec, *tmp, *addr; u32 intsize, intlen; - int i, res = -EINVAL; + int i, res; pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index); @@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar /* Get size of interrupt specifier */ tmp = of_get_property(p, "#interrupt-cells", NULL); - if (tmp == NULL) + if (tmp == NULL) { + res = -EINVAL; goto out; + } intsize = be32_to_cpu(*tmp); pr_debug(" intsize=%d intlen=%d\n", intsize, intlen); /* Check index */ - if ((index + 1) * intsize > intlen) + if ((index + 1) * intsize > intlen) { + res = -EINVAL; goto out; + } /* Copy intspec into irq structure */ intspec += index * intsize; |