* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-20 14:00 Gustavo A. R. Silva
2017-11-21 8:22 ` Patrice CHOTARD
0 siblings, 1 reply; 4+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-20 14:00 UTC (permalink / raw)
To: Patrice Chotard, Mauro Carvalho Chehab
Cc: linux-arm-kernel, linux-media, linux-kernel, Gustavo A. R. Silva
_channel_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference. Fix this by moving the pointer dereference
after _channel_ has been null checked.
This issue was detected with the help of Coccinelle.
Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
index 59280ac..23d0ced 100644
--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
static void channel_swdemux_tsklet(unsigned long data)
{
struct channel_info *channel = (struct channel_info *)data;
- struct c8sectpfei *fei = channel->fei;
+ struct c8sectpfei *fei;
unsigned long wp, rp;
int pos, num_packets, n, size;
u8 *buf;
@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
if (unlikely(!channel || !channel->irec))
return;
+ fei = channel->fei;
+
wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
--
2.7.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
2017-11-20 14:00 [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Gustavo A. R. Silva
@ 2017-11-21 8:22 ` Patrice CHOTARD
2017-11-22 14:21 ` Gustavo A. R. Silva
2017-12-05 17:27 ` Gustavo A. R. Silva
0 siblings, 2 replies; 4+ messages in thread
From: Patrice CHOTARD @ 2017-11-21 8:22 UTC (permalink / raw)
To: Gustavo A. R. Silva, Mauro Carvalho Chehab
Cc: linux-arm-kernel, linux-media, linux-kernel
Hi Gustavo
On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
> _channel_ is being dereferenced before it is null checked, hence there is a
> potential null pointer dereference. Fix this by moving the pointer dereference
> after _channel_ has been null checked.
>
> This issue was detected with the help of Coccinelle.
>
> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> index 59280ac..23d0ced 100644
> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
> static void channel_swdemux_tsklet(unsigned long data)
> {
> struct channel_info *channel = (struct channel_info *)data;
> - struct c8sectpfei *fei = channel->fei;
> + struct c8sectpfei *fei;
> unsigned long wp, rp;
> int pos, num_packets, n, size;
> u8 *buf;
> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
> if (unlikely(!channel || !channel->irec))
> return;
>
> + fei = channel->fei;
> +
> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>
>
Acked-by: Patrice Chotard <patrice.chotard@st.com>
Thanks
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
2017-11-21 8:22 ` Patrice CHOTARD
@ 2017-11-22 14:21 ` Gustavo A. R. Silva
2017-12-05 17:27 ` Gustavo A. R. Silva
1 sibling, 0 replies; 4+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-22 14:21 UTC (permalink / raw)
To: Patrice CHOTARD, Mauro Carvalho Chehab
Cc: linux-arm-kernel, linux-media, linux-kernel
On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>> static void channel_swdemux_tsklet(unsigned long data)
>> {
>> struct channel_info *channel = (struct channel_info *)data;
>> - struct c8sectpfei *fei = channel->fei;
>> + struct c8sectpfei *fei;
>> unsigned long wp, rp;
>> int pos, num_packets, n, size;
>> u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>> if (unlikely(!channel || !channel->irec))
>> return;
>>
>> + fei = channel->fei;
>> +
>> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks
Thank you, Patrice.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
2017-11-21 8:22 ` Patrice CHOTARD
2017-11-22 14:21 ` Gustavo A. R. Silva
@ 2017-12-05 17:27 ` Gustavo A. R. Silva
1 sibling, 0 replies; 4+ messages in thread
From: Gustavo A. R. Silva @ 2017-12-05 17:27 UTC (permalink / raw)
To: Patrice CHOTARD, Mauro Carvalho Chehab
Cc: linux-arm-kernel, linux-media, linux-kernel
Hello,
On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>> static void channel_swdemux_tsklet(unsigned long data)
>> {
>> struct channel_info *channel = (struct channel_info *)data;
>> - struct c8sectpfei *fei = channel->fei;
>> + struct c8sectpfei *fei;
>> unsigned long wp, rp;
>> int pos, num_packets, n, size;
>> u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>> if (unlikely(!channel || !channel->irec))
>> return;
>>
>> + fei = channel->fei;
>> +
>> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks
Thank you, Patrice.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-12-05 17:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-11-20 14:00 [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Gustavo A. R. Silva
2017-11-21 8:22 ` Patrice CHOTARD
2017-11-22 14:21 ` Gustavo A. R. Silva
2017-12-05 17:27 ` Gustavo A. R. Silva
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).