From: Nadezda Lutovinova <lutovinova@ispras.ru>
To: Marc Hulsman <m.hulsman@tudelft.nl>
Cc: Nadezda Lutovinova <lutovinova@ispras.ru>,
Jean Delvare <jdelvare@suse.com>,
Guenter Roeck <linux@roeck-us.net>,
Rudolf Marek <r.marek@assembler.cz>,
linux-hwmon@vger.kernel.org, linux-kernel@vger.kernel.org,
ldv-project@linuxtesting.org
Subject: [PATCH] hwmon: Correct the error handling in w83793.c, w83791d.c, w83792d.c
Date: Wed, 11 Aug 2021 19:15:15 +0300 [thread overview]
Message-ID: <20210811161515.17842-2-lutovinova@ispras.ru> (raw)
In-Reply-To: <20210811161515.17842-1-lutovinova@ispras.ru>
If driver read tmp (or val) value sufficient for
(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
The patch adds checking if data->lm75[0] is NULL.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
---
drivers/hwmon/w83791d.c | 2 +-
drivers/hwmon/w83792d.c | 2 +-
drivers/hwmon/w83793.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 37b25a1474c4..8b30bbfafaa7 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -1284,7 +1284,7 @@ static int w83791d_detect_subclients(struct i2c_client *client)
data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
0x48 + (val & 0x7));
if (!(val & 0x80)) {
- if (!IS_ERR(data->lm75[0]) &&
+ if (!IS_ERR_OR_NULL(data->lm75[0]) &&
((val & 0x7) == ((val >> 4) & 0x7))) {
dev_err(&client->dev,
"duplicate addresses 0x%x, "
diff --git a/drivers/hwmon/w83792d.c b/drivers/hwmon/w83792d.c
index abd5c3a722b9..85ae12d950e1 100644
--- a/drivers/hwmon/w83792d.c
+++ b/drivers/hwmon/w83792d.c
@@ -950,7 +950,7 @@ w83792d_detect_subclients(struct i2c_client *new_client)
data->lm75[0] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
0x48 + (val & 0x7));
if (!(val & 0x80)) {
- if (!IS_ERR(data->lm75[0]) &&
+ if (!IS_ERR_OR_NULL(data->lm75[0]) &&
((val & 0x7) == ((val >> 4) & 0x7))) {
dev_err(&new_client->dev,
"duplicate addresses 0x%x, use force_subclient\n",
diff --git a/drivers/hwmon/w83793.c b/drivers/hwmon/w83793.c
index e7d0484eabe4..9d8c44e2fa6e 100644
--- a/drivers/hwmon/w83793.c
+++ b/drivers/hwmon/w83793.c
@@ -1590,7 +1590,7 @@ w83793_detect_subclients(struct i2c_client *client)
data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
0x48 + (tmp & 0x7));
if (!(tmp & 0x80)) {
- if (!IS_ERR(data->lm75[0])
+ if (!IS_ERR_OR_NULL(data->lm75[0])
&& ((tmp & 0x7) == ((tmp >> 4) & 0x7))) {
dev_err(&client->dev,
"duplicate addresses 0x%x, "
--
2.17.1
next prev parent reply other threads:[~2021-08-11 16:15 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-11 16:15 hwmon: Error handling in w83793.c, w83791d.c, w83792d.c Nadezda Lutovinova
2021-08-11 16:15 ` Nadezda Lutovinova [this message]
2021-08-11 18:18 ` [PATCH] hwmon: Correct the error " Guenter Roeck
2021-09-21 15:51 ` [PATCH v2 1/3] hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field Nadezda Lutovinova
2021-10-02 12:07 ` Guenter Roeck
2021-09-21 15:51 ` [PATCH v2 2/3] hwmon: (w83792d) " Nadezda Lutovinova
2021-10-02 12:12 ` Guenter Roeck
2021-09-21 15:51 ` [PATCH v2 3/3] hwmon: (w83793) " Nadezda Lutovinova
2021-10-02 12:15 ` Guenter Roeck
2021-08-11 17:51 ` hwmon: Error handling in w83793.c, w83791d.c, w83792d.c Guenter Roeck
2021-08-11 18:19 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210811161515.17842-2-lutovinova@ispras.ru \
--to=lutovinova@ispras.ru \
--cc=jdelvare@suse.com \
--cc=ldv-project@linuxtesting.org \
--cc=linux-hwmon@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=m.hulsman@tudelft.nl \
--cc=r.marek@assembler.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.