From 56e16e2ba7582bd85d462e6102ff5828a6c3282b Mon Sep 17 00:00:00 2001
From: Mahammad Ismayilzada <mahammad.ismayilzada@freescale.com>
Date: Tue, 23 Jun 2015 18:12:23 -0400
Subject: fsl-pme: Check for null pointers

Check for null pointers to prevent null pointer dereferencing

Signed-off-by: Mahammad Ismayilzada <mahammad.ismayilzada@freescale.com>
Change-Id: Icc267f51d5ad85187c6ee5d03aa87f8649e124c9

diff --git a/drivers/staging/fsl_pme2/pme2_ctrl.c b/drivers/staging/fsl_pme2/pme2_ctrl.c
index 388162b..56e2443 100644
--- a/drivers/staging/fsl_pme2/pme2_ctrl.c
+++ b/drivers/staging/fsl_pme2/pme2_ctrl.c
@@ -138,6 +138,10 @@ static __init int parse_mem_property(struct device_node *node, const char *name,
 	} else if (zero) {
 		/* map as cacheable, non-guarded */
 		void *tmpp = ioremap_prot(*addr, *sz, 0);
+		if (!tmpp) {
+			pr_err("pme: Failed to remap\n");
+			return -EINVAL;
+		}
 		memset(tmpp, 0, *sz);
 		iounmap(tmpp);
 	}
diff --git a/drivers/staging/fsl_pme2/pme2_db.c b/drivers/staging/fsl_pme2/pme2_db.c
index 50263d5..0cc13fc 100644
--- a/drivers/staging/fsl_pme2/pme2_db.c
+++ b/drivers/staging/fsl_pme2/pme2_db.c
@@ -295,6 +295,7 @@ comp_frame_free_rx:
 	kfree(rx_data);
 	goto unmap_input_frame;
 single_frame_unmap_frame:
+	kfree(rx_data);
 unmap_input_frame:
 free_tx_data:
 	kfree(tx_data);
diff --git a/drivers/staging/fsl_pme2/pme2_high.c b/drivers/staging/fsl_pme2/pme2_high.c
index 12ab7a1..e39bfc6 100644
--- a/drivers/staging/fsl_pme2/pme2_high.c
+++ b/drivers/staging/fsl_pme2/pme2_high.c
@@ -933,6 +933,7 @@ static inline void cb_helper(__always_unused struct qman_portal *portal,
 	if (error)
 		do_flags(ctx, 0, 0, PME_CTX_FLAG_DEAD, 0);
 	token = pop_matching_token(ctx, fd);
+	BUG_ON(!token);
 	if (likely(token->cmd_type == pme_cmd_scan)) {
 		ctx->cb(ctx, fd, token);
 	} else if (token->cmd_type == pme_cmd_pmtcc) {
@@ -1002,6 +1003,7 @@ static void cb_ern(__always_unused struct qman_portal *portal,
 	ctx = data->parent;
 
 	token = pop_matching_token(ctx, &mr->ern.fd);
+	BUG_ON(!token);
 	if (likely(token->cmd_type == pme_cmd_scan)) {
 		BUG_ON(!ctx->ern_cb);
 		ctx->ern_cb(ctx, mr, token);
-- 
cgit v0.10.2