* [mfd] question about potential null pointer dereference
@ 2017-05-23 21:33 Gustavo A. R. Silva
2017-05-24 7:22 ` Lee Jones
0 siblings, 1 reply; 12+ messages in thread
From: Gustavo A. R. Silva @ 2017-05-23 21:33 UTC (permalink / raw)
To: Lee Jones; +Cc: patches, linux-kernel
Hello everybody,
While looking into Coverity ID 1408830 I ran into the following piece
of code at drivers/mfd/wm831x-spi.c:26
26static int wm831x_spi_probe(struct spi_device *spi)
27{
28 struct wm831x_pdata *pdata = dev_get_platdata(&spi->dev);
29 const struct spi_device_id *id = spi_get_device_id(spi);
30 const struct of_device_id *of_id;
31 struct wm831x *wm831x;
32 enum wm831x_parent type;
33 int ret;
34
35 if (spi->dev.of_node) {
36 of_id = of_match_device(wm831x_of_match, &spi->dev);
37 type = (enum wm831x_parent)of_id->data;
38 } else {
39 type = (enum wm831x_parent)id->driver_data;
40 }
41
42 wm831x = devm_kzalloc(&spi->dev, sizeof(struct wm831x),
GFP_KERNEL);
43 if (wm831x == NULL)
44 return -ENOMEM;
45
46 spi->mode = SPI_MODE_0;
47
48 spi_set_drvdata(spi, wm831x);
49 wm831x->dev = &spi->dev;
50 wm831x->type = type;
51
52 wm831x->regmap = devm_regmap_init_spi(spi, &wm831x_regmap_config);
53 if (IS_ERR(wm831x->regmap)) {
54 ret = PTR_ERR(wm831x->regmap);
55 dev_err(wm831x->dev, "Failed to allocate register
map: %d\n",
56 ret);
57 return ret;
58 }
59
60 if (pdata)
61 memcpy(&wm831x->pdata, pdata, sizeof(*pdata));
62
63 return wm831x_device_init(wm831x, spi->irq);
64}
The issue here is that there is a potential NULL pointer dereference
at line 37, in case function of_match_device() returns NULL.
Maybe a patch like the following could be applied in order to avoid
any chance of a NULL pointer dereference:
index c332e28..7b227c9 100644
--- a/drivers/mfd/wm831x-spi.c
+++ b/drivers/mfd/wm831x-spi.c
@@ -34,6 +34,10 @@ static int wm831x_spi_probe(struct spi_device *spi)
if (spi->dev.of_node) {
of_id = of_match_device(wm831x_of_match, &spi->dev);
+ if (!of_id) {
+ dev_err(&spi->dev, "Failed to find matching id\n");
+ return -EINVAL;
+ }
type = (enum wm831x_parent)of_id->data;
} else {
type = (enum wm831x_parent)id->driver_data;
What do you think?
I'd really appreciate any comment on this.
Thank you!
--
Gustavo A. R. Silva
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [mfd] question about potential null pointer dereference
2017-05-23 21:33 [mfd] question about potential null pointer dereference Gustavo A. R. Silva
@ 2017-05-24 7:22 ` Lee Jones
2017-05-24 8:09 ` Charles Keepax
0 siblings, 1 reply; 12+ messages in thread
From: Lee Jones @ 2017-05-24 7:22 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: patches, linux-kernel
On Tue, 23 May 2017, Gustavo A. R. Silva wrote:
>
> Hello everybody,
>
> While looking into Coverity ID 1408830 I ran into the following piece of
> code at drivers/mfd/wm831x-spi.c:26
>
> 26static int wm831x_spi_probe(struct spi_device *spi)
> 27{
> 28 struct wm831x_pdata *pdata = dev_get_platdata(&spi->dev);
> 29 const struct spi_device_id *id = spi_get_device_id(spi);
> 30 const struct of_device_id *of_id;
> 31 struct wm831x *wm831x;
> 32 enum wm831x_parent type;
> 33 int ret;
> 34
> 35 if (spi->dev.of_node) {
> 36 of_id = of_match_device(wm831x_of_match, &spi->dev);
> 37 type = (enum wm831x_parent)of_id->data;
> 38 } else {
> 39 type = (enum wm831x_parent)id->driver_data;
> 40 }
> 41
> 42 wm831x = devm_kzalloc(&spi->dev, sizeof(struct wm831x),
> GFP_KERNEL);
> 43 if (wm831x == NULL)
> 44 return -ENOMEM;
> 45
> 46 spi->mode = SPI_MODE_0;
> 47
> 48 spi_set_drvdata(spi, wm831x);
> 49 wm831x->dev = &spi->dev;
> 50 wm831x->type = type;
> 51
> 52 wm831x->regmap = devm_regmap_init_spi(spi, &wm831x_regmap_config);
> 53 if (IS_ERR(wm831x->regmap)) {
> 54 ret = PTR_ERR(wm831x->regmap);
> 55 dev_err(wm831x->dev, "Failed to allocate register map:
> %d\n",
> 56 ret);
> 57 return ret;
> 58 }
> 59
> 60 if (pdata)
> 61 memcpy(&wm831x->pdata, pdata, sizeof(*pdata));
> 62
> 63 return wm831x_device_init(wm831x, spi->irq);
> 64}
>
> The issue here is that there is a potential NULL pointer dereference at line
> 37, in case function of_match_device() returns NULL.
>
> Maybe a patch like the following could be applied in order to avoid any
> chance of a NULL pointer dereference:
I do not believe it's possible for of_match_device() to return NULL in
this case.
However, if you wanted to submit a patch checking for it, it would not
be rejected.
> index c332e28..7b227c9 100644
> --- a/drivers/mfd/wm831x-spi.c
> +++ b/drivers/mfd/wm831x-spi.c
> @@ -34,6 +34,10 @@ static int wm831x_spi_probe(struct spi_device *spi)
>
> if (spi->dev.of_node) {
> of_id = of_match_device(wm831x_of_match, &spi->dev);
> + if (!of_id) {
> + dev_err(&spi->dev, "Failed to find matching id\n");
"Failed to match device"
> + return -EINVAL;
-ENODEV
> type = (enum wm831x_parent)of_id->data;
> } else {
> type = (enum wm831x_parent)id->driver_data;
>
> What do you think?
>
> I'd really appreciate any comment on this.
>
> Thank you!
--
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [mfd] question about potential null pointer dereference
2017-05-24 7:22 ` Lee Jones
@ 2017-05-24 8:09 ` Charles Keepax
2017-05-24 8:19 ` Gustavo A. R. Silva
0 siblings, 1 reply; 12+ messages in thread
From: Charles Keepax @ 2017-05-24 8:09 UTC (permalink / raw)
To: Lee Jones; +Cc: Gustavo A. R. Silva, patches, linux-kernel
On Wed, May 24, 2017 at 08:22:58AM +0100, Lee Jones wrote:
> On Tue, 23 May 2017, Gustavo A. R. Silva wrote:
> > The issue here is that there is a potential NULL pointer dereference at line
> > 37, in case function of_match_device() returns NULL.
> >
> > Maybe a patch like the following could be applied in order to avoid any
> > chance of a NULL pointer dereference:
>
> I do not believe it's possible for of_match_device() to return NULL in
> this case.
>
> However, if you wanted to submit a patch checking for it, it would not
> be rejected.
Personally I would prefer to have a NULL pointer check in there.
Thanks,
Charles
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [mfd] question about potential null pointer dereference
2017-05-24 8:09 ` Charles Keepax
@ 2017-05-24 8:19 ` Gustavo A. R. Silva
2017-05-24 8:27 ` [PATCH] mfd: add null check before " Gustavo A. R. Silva
0 siblings, 1 reply; 12+ messages in thread
From: Gustavo A. R. Silva @ 2017-05-24 8:19 UTC (permalink / raw)
To: Charles Keepax; +Cc: Lee Jones, patches, linux-kernel
Hi guys,
Quoting Charles Keepax <ckeepax@opensource.wolfsonmicro.com>:
> On Wed, May 24, 2017 at 08:22:58AM +0100, Lee Jones wrote:
>> On Tue, 23 May 2017, Gustavo A. R. Silva wrote:
>> > The issue here is that there is a potential NULL pointer
>> dereference at line
>> > 37, in case function of_match_device() returns NULL.
>> >
>> > Maybe a patch like the following could be applied in order to avoid any
>> > chance of a NULL pointer dereference:
>>
>> I do not believe it's possible for of_match_device() to return NULL in
>> this case.
>>
>> However, if you wanted to submit a patch checking for it, it would not
>> be rejected.
>
> Personally I would prefer to have a NULL pointer check in there.
>
I'll send a patch shortly.
Thank you both.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH] mfd: add null check before pointer dereference
2017-05-24 8:19 ` Gustavo A. R. Silva
@ 2017-05-24 8:27 ` Gustavo A. R. Silva
2017-05-24 8:41 ` Charles Keepax
2017-05-24 8:43 ` Lee Jones
0 siblings, 2 replies; 12+ messages in thread
From: Gustavo A. R. Silva @ 2017-05-24 8:27 UTC (permalink / raw)
To: Lee Jones, Charles Keepax; +Cc: patches, linux-kernel, Gustavo A. R. Silva
Add null check before dereferencing pointer of_id in order to avoid
a potential NULL pointer dereference.
Addresses-Coverity-ID: 1408830
Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/mfd/wm831x-spi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/wm831x-spi.c b/drivers/mfd/wm831x-spi.c
index c332e28..7b227c9 100644
--- a/drivers/mfd/wm831x-spi.c
+++ b/drivers/mfd/wm831x-spi.c
@@ -34,6 +34,10 @@ static int wm831x_spi_probe(struct spi_device *spi)
if (spi->dev.of_node) {
of_id = of_match_device(wm831x_of_match, &spi->dev);
+ if (!of_id) {
+ dev_err(&spi->dev, "Failed to find matching id\n");
+ return -EINVAL;
+ }
type = (enum wm831x_parent)of_id->data;
} else {
type = (enum wm831x_parent)id->driver_data;
--
2.5.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH] mfd: add null check before pointer dereference
2017-05-24 8:27 ` [PATCH] mfd: add null check before " Gustavo A. R. Silva
@ 2017-05-24 8:41 ` Charles Keepax
2017-05-24 8:43 ` Lee Jones
1 sibling, 0 replies; 12+ messages in thread
From: Charles Keepax @ 2017-05-24 8:41 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: Lee Jones, patches, linux-kernel
On Wed, May 24, 2017 at 03:27:31AM -0500, Gustavo A. R. Silva wrote:
> Add null check before dereferencing pointer of_id in order to avoid
> a potential NULL pointer dereference.
>
> Addresses-Coverity-ID: 1408830
> Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Looks good although is there not probably the same issue in
wm831x-i2c.c? Might be worth fixing up both of them.
Thanks,
Charles
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] mfd: add null check before pointer dereference
2017-05-24 8:27 ` [PATCH] mfd: add null check before " Gustavo A. R. Silva
2017-05-24 8:41 ` Charles Keepax
@ 2017-05-24 8:43 ` Lee Jones
2017-05-24 8:50 ` Gustavo A. R. Silva
1 sibling, 1 reply; 12+ messages in thread
From: Lee Jones @ 2017-05-24 8:43 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: Charles Keepax, patches, linux-kernel
Please use the $SUBJECT line expected by the subsystem.
The following command can help with this:
`git log --oneline -- <SUBSYSTEM>`
> Add null check before dereferencing pointer of_id in order to avoid
> a potential NULL pointer dereference.
>
> Addresses-Coverity-ID: 1408830
> Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
> drivers/mfd/wm831x-spi.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/mfd/wm831x-spi.c b/drivers/mfd/wm831x-spi.c
> index c332e28..7b227c9 100644
> --- a/drivers/mfd/wm831x-spi.c
> +++ b/drivers/mfd/wm831x-spi.c
> @@ -34,6 +34,10 @@ static int wm831x_spi_probe(struct spi_device *spi)
>
> if (spi->dev.of_node) {
> of_id = of_match_device(wm831x_of_match, &spi->dev);
> + if (!of_id) {
> + dev_err(&spi->dev, "Failed to find matching id\n");
> + return -EINVAL;
> + }
I already mentioned why this isn't suitable.
Please see my pre-review.
> type = (enum wm831x_parent)of_id->data;
> } else {
> type = (enum wm831x_parent)id->driver_data;
--
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] mfd: add null check before pointer dereference
2017-05-24 8:43 ` Lee Jones
@ 2017-05-24 8:50 ` Gustavo A. R. Silva
2017-05-24 9:18 ` [PATCH v2] mfd: wm831x: " Gustavo A. R. Silva
0 siblings, 1 reply; 12+ messages in thread
From: Gustavo A. R. Silva @ 2017-05-24 8:50 UTC (permalink / raw)
To: Lee Jones; +Cc: Charles Keepax, patches, linux-kernel
Hi Lee,
Quoting Lee Jones <lee.jones@linaro.org>:
> Please use the $SUBJECT line expected by the subsystem.
>
> The following command can help with this:
>
> `git log --oneline -- <SUBSYSTEM>`
>
I get it.
>> Add null check before dereferencing pointer of_id in order to avoid
>> a potential NULL pointer dereference.
>>
>> Addresses-Coverity-ID: 1408830
>> Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> drivers/mfd/wm831x-spi.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/mfd/wm831x-spi.c b/drivers/mfd/wm831x-spi.c
>> index c332e28..7b227c9 100644
>> --- a/drivers/mfd/wm831x-spi.c
>> +++ b/drivers/mfd/wm831x-spi.c
>> @@ -34,6 +34,10 @@ static int wm831x_spi_probe(struct spi_device *spi)
>>
>> if (spi->dev.of_node) {
>> of_id = of_match_device(wm831x_of_match, &spi->dev);
>> + if (!of_id) {
>> + dev_err(&spi->dev, "Failed to find matching id\n");
>> + return -EINVAL;
>> + }
>
> I already mentioned why this isn't suitable.
>
> Please see my pre-review.
>
You are right. Let me fix that.
Thanks
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v2] mfd: wm831x: add null check before pointer dereference
2017-05-24 8:50 ` Gustavo A. R. Silva
@ 2017-05-24 9:18 ` Gustavo A. R. Silva
2017-05-24 10:52 ` Lee Jones
0 siblings, 1 reply; 12+ messages in thread
From: Gustavo A. R. Silva @ 2017-05-24 9:18 UTC (permalink / raw)
To: Lee Jones, Charles Keepax; +Cc: patches, linux-kernel, Gustavo A. R. Silva
Add NULL check before dereferencing pointer of_id in order to avoid
a potential NULL pointer dereference.
Addresses-Coverity-ID: 1408830
Cc: Lee Jones <lee.jones@linaro.org>
Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
Changes in v2:
Update error log and return value.
drivers/mfd/wm831x-spi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/wm831x-spi.c b/drivers/mfd/wm831x-spi.c
index c332e28..018ce65 100644
--- a/drivers/mfd/wm831x-spi.c
+++ b/drivers/mfd/wm831x-spi.c
@@ -34,6 +34,10 @@ static int wm831x_spi_probe(struct spi_device *spi)
if (spi->dev.of_node) {
of_id = of_match_device(wm831x_of_match, &spi->dev);
+ if (!of_id) {
+ dev_err(&spi->dev, "Failed to match device\n");
+ return -ENODEV;
+ }
type = (enum wm831x_parent)of_id->data;
} else {
type = (enum wm831x_parent)id->driver_data;
--
2.5.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH v2] mfd: wm831x: add null check before pointer dereference
2017-05-24 9:18 ` [PATCH v2] mfd: wm831x: " Gustavo A. R. Silva
@ 2017-05-24 10:52 ` Lee Jones
0 siblings, 0 replies; 12+ messages in thread
From: Lee Jones @ 2017-05-24 10:52 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: Charles Keepax, patches, linux-kernel
On Wed, 24 May 2017, Gustavo A. R. Silva wrote:
> Add NULL check before dereferencing pointer of_id in order to avoid
> a potential NULL pointer dereference.
>
> Addresses-Coverity-ID: 1408830
> Cc: Lee Jones <lee.jones@linaro.org>
> Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
> Changes in v2:
> Update error log and return value.
>
> drivers/mfd/wm831x-spi.c | 4 ++++
> 1 file changed, 4 insertions(+)
Applied, thanks.
> diff --git a/drivers/mfd/wm831x-spi.c b/drivers/mfd/wm831x-spi.c
> index c332e28..018ce65 100644
> --- a/drivers/mfd/wm831x-spi.c
> +++ b/drivers/mfd/wm831x-spi.c
> @@ -34,6 +34,10 @@ static int wm831x_spi_probe(struct spi_device *spi)
>
> if (spi->dev.of_node) {
> of_id = of_match_device(wm831x_of_match, &spi->dev);
> + if (!of_id) {
> + dev_err(&spi->dev, "Failed to match device\n");
> + return -ENODEV;
> + }
> type = (enum wm831x_parent)of_id->data;
> } else {
> type = (enum wm831x_parent)id->driver_data;
--
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] mfd: add null check before pointer dereference
2017-05-24 8:37 [PATCH] mfd: " Gustavo A. R. Silva
@ 2017-05-24 8:42 ` Charles Keepax
0 siblings, 0 replies; 12+ messages in thread
From: Charles Keepax @ 2017-05-24 8:42 UTC (permalink / raw)
To: Gustavo A. R. Silva; +Cc: Lee Jones, patches, linux-kernel
On Wed, May 24, 2017 at 03:37:58AM -0500, Gustavo A. R. Silva wrote:
> Add NULL check before dereferencing pointer of_id in order to avoid
> a potential NULL pointer dereference.
>
> Addresses-Coverity-ID: 1408829
> Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Thanks,
Charles
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH] mfd: add null check before pointer dereference
@ 2017-05-24 8:37 Gustavo A. R. Silva
2017-05-24 8:42 ` Charles Keepax
0 siblings, 1 reply; 12+ messages in thread
From: Gustavo A. R. Silva @ 2017-05-24 8:37 UTC (permalink / raw)
To: Lee Jones, Charles Keepax; +Cc: patches, linux-kernel, Gustavo A. R. Silva
Add NULL check before dereferencing pointer of_id in order to avoid
a potential NULL pointer dereference.
Addresses-Coverity-ID: 1408829
Cc: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/mfd/wm831x-i2c.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/wm831x-i2c.c b/drivers/mfd/wm831x-i2c.c
index 781af06..2d48f41 100644
--- a/drivers/mfd/wm831x-i2c.c
+++ b/drivers/mfd/wm831x-i2c.c
@@ -37,6 +37,10 @@ static int wm831x_i2c_probe(struct i2c_client *i2c,
if (i2c->dev.of_node) {
of_id = of_match_device(wm831x_of_match, &i2c->dev);
+ if (!of_id) {
+ dev_err(&i2c->dev, "Failed to find matching id\n");
+ return -EINVAL;
+ }
type = (enum wm831x_parent)of_id->data;
} else {
type = (enum wm831x_parent)id->driver_data;
--
2.5.0
^ permalink raw reply related [flat|nested] 12+ messages in thread
end of thread, other threads:[~2017-05-24 10:53 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-23 21:33 [mfd] question about potential null pointer dereference Gustavo A. R. Silva
2017-05-24 7:22 ` Lee Jones
2017-05-24 8:09 ` Charles Keepax
2017-05-24 8:19 ` Gustavo A. R. Silva
2017-05-24 8:27 ` [PATCH] mfd: add null check before " Gustavo A. R. Silva
2017-05-24 8:41 ` Charles Keepax
2017-05-24 8:43 ` Lee Jones
2017-05-24 8:50 ` Gustavo A. R. Silva
2017-05-24 9:18 ` [PATCH v2] mfd: wm831x: " Gustavo A. R. Silva
2017-05-24 10:52 ` Lee Jones
2017-05-24 8:37 [PATCH] mfd: " Gustavo A. R. Silva
2017-05-24 8:42 ` Charles Keepax
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).