mtd: docg3: off by one in doc_register_sysfs()

Smatch found a bug in the error handling:

	drivers/mtd/devices/docg3.c:1634 doc_register_sysfs()
	error: buffer overflow 'doc_sys_attrs' 4 <= 4

The problem is that if the very last device_create_file() fails, then we
are beyond the end of the array.  Actually, any time i == 3 then there
is a problem.  We can fix this an simplify the code at the same time by
moving the !ret conditions out of the for loops and using a goto
instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index f00d0dae917f3aee5d5d1050d4b5496bb8d2547b..c3a2695a442035ce269d0ca9bc79becf4450932b 100644 (file)
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -1620,20 +1620,30 @@ static struct device_attribute doc_sys_attrs[DOC_MAX_NBFLOORS][4] = {
 static int doc_register_sysfs(struct platform_device *pdev,
                              struct docg3_cascade *cascade)
 {
-       int ret = 0, floor, i = 0;
        struct device *dev = &pdev->dev;
+       int floor;
+       int ret;
+       int i;
 
-       for (floor = 0; !ret && floor < DOC_MAX_NBFLOORS &&
-                    cascade->floors[floor]; floor++)
-               for (i = 0; !ret && i < 4; i++)
+       for (floor = 0;
+            floor < DOC_MAX_NBFLOORS && cascade->floors[floor];
+            floor++) {
+               for (i = 0; i < 4; i++) {
                        ret = device_create_file(dev, &doc_sys_attrs[floor][i]);
-       if (!ret)
-               return 0;
+                       if (ret)
+                               goto remove_files;
+               }
+       }
+
+       return 0;
+
+remove_files:
        do {
                while (--i >= 0)
                        device_remove_file(dev, &doc_sys_attrs[floor][i]);
                i = 4;
        } while (--floor >= 0);
+
        return ret;
 }