* [PATCH] media: renesas-ceu: fix a potential NULL pointer dereference
@ 2019-03-09 7:14 Kangjie Lu
2019-03-09 9:58 ` Jacopo Mondi
2019-03-28 15:30 ` Hans Verkuil
0 siblings, 2 replies; 3+ messages in thread
From: Kangjie Lu @ 2019-03-09 7:14 UTC (permalink / raw)
To: kjlu
Cc: pakki001, Jacopo Mondi, Mauro Carvalho Chehab, linux-media,
linux-renesas-soc, linux-kernel
In case of_match_device cannot find a match, the check returns
-EINVAL to avoid a potential NULL pointer dereference
Signed-off-by: Kangjie Lu <kjlu@umn.edu>
---
drivers/media/platform/renesas-ceu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/renesas-ceu.c b/drivers/media/platform/renesas-ceu.c
index 150196f7cf96..4aa807c0b6c7 100644
--- a/drivers/media/platform/renesas-ceu.c
+++ b/drivers/media/platform/renesas-ceu.c
@@ -1682,7 +1682,10 @@ static int ceu_probe(struct platform_device *pdev)
if (IS_ENABLED(CONFIG_OF) && dev->of_node) {
ceu_data = of_match_device(ceu_of_match, dev)->data;
- num_subdevs = ceu_parse_dt(ceudev);
+ if (unlikely(!ceu_data))
+ num_subdevs = -EINVAL;
+ else
+ num_subdevs = ceu_parse_dt(ceudev);
} else if (dev->platform_data) {
/* Assume SH4 if booting with platform data. */
ceu_data = &ceu_data_sh4;
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] media: renesas-ceu: fix a potential NULL pointer dereference
2019-03-09 7:14 [PATCH] media: renesas-ceu: fix a potential NULL pointer dereference Kangjie Lu
@ 2019-03-09 9:58 ` Jacopo Mondi
2019-03-28 15:30 ` Hans Verkuil
1 sibling, 0 replies; 3+ messages in thread
From: Jacopo Mondi @ 2019-03-09 9:58 UTC (permalink / raw)
To: Kangjie Lu
Cc: pakki001, Mauro Carvalho Chehab, linux-media, linux-renesas-soc,
linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1551 bytes --]
Hi Kangjie,
thanks for the patch.
On Sat, Mar 09, 2019 at 01:14:24AM -0600, Kangjie Lu wrote:
> In case of_match_device cannot find a match, the check returns
> -EINVAL to avoid a potential NULL pointer dereference
>
> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> ---
> drivers/media/platform/renesas-ceu.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/renesas-ceu.c b/drivers/media/platform/renesas-ceu.c
> index 150196f7cf96..4aa807c0b6c7 100644
> --- a/drivers/media/platform/renesas-ceu.c
> +++ b/drivers/media/platform/renesas-ceu.c
> @@ -1682,7 +1682,10 @@ static int ceu_probe(struct platform_device *pdev)
>
> if (IS_ENABLED(CONFIG_OF) && dev->of_node) {
> ceu_data = of_match_device(ceu_of_match, dev)->data;
> - num_subdevs = ceu_parse_dt(ceudev);
> + if (unlikely(!ceu_data))
> + num_subdevs = -EINVAL;
> + else
> + num_subdevs = ceu_parse_dt(ceudev);
I don't think this fix is required to be honest.
If we call of_match_device() here we're sure CONFIG_OF is enabled, and
if the driver probed, so a matching compatible string has proved to
exist.
Furthermore, if you want to protect against of_match_device()
returning a NULL pointer, you should change this line first, as it
would dereference an invalid pointer:
ceu_data = of_match_device(ceu_of_match, dev)->data;
but again, I don't think this might happen.
Thanks
j
> } else if (dev->platform_data) {
> /* Assume SH4 if booting with platform data. */
> ceu_data = &ceu_data_sh4;
> --
> 2.17.1
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] media: renesas-ceu: fix a potential NULL pointer dereference
2019-03-09 7:14 [PATCH] media: renesas-ceu: fix a potential NULL pointer dereference Kangjie Lu
2019-03-09 9:58 ` Jacopo Mondi
@ 2019-03-28 15:30 ` Hans Verkuil
1 sibling, 0 replies; 3+ messages in thread
From: Hans Verkuil @ 2019-03-28 15:30 UTC (permalink / raw)
To: Kangjie Lu
Cc: pakki001, Jacopo Mondi, Mauro Carvalho Chehab, linux-media,
linux-renesas-soc, linux-kernel
On 3/9/19 8:14 AM, Kangjie Lu wrote:
> In case of_match_device cannot find a match, the check returns
> -EINVAL to avoid a potential NULL pointer dereference
>
> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> ---
> drivers/media/platform/renesas-ceu.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/renesas-ceu.c b/drivers/media/platform/renesas-ceu.c
> index 150196f7cf96..4aa807c0b6c7 100644
> --- a/drivers/media/platform/renesas-ceu.c
> +++ b/drivers/media/platform/renesas-ceu.c
> @@ -1682,7 +1682,10 @@ static int ceu_probe(struct platform_device *pdev)
>
> if (IS_ENABLED(CONFIG_OF) && dev->of_node) {
> ceu_data = of_match_device(ceu_of_match, dev)->data;
> - num_subdevs = ceu_parse_dt(ceudev);
A far as I can tell ceu_parse_dt will never return 0.
I'm dropping this patch.
Regards,
Hans
> + if (unlikely(!ceu_data))
> + num_subdevs = -EINVAL;
> + else
> + num_subdevs = ceu_parse_dt(ceudev);
> } else if (dev->platform_data) {
> /* Assume SH4 if booting with platform data. */
> ceu_data = &ceu_data_sh4;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-03-28 15:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-09 7:14 [PATCH] media: renesas-ceu: fix a potential NULL pointer dereference Kangjie Lu
2019-03-09 9:58 ` Jacopo Mondi
2019-03-28 15:30 ` Hans Verkuil
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).