* [PATCH v3] input: touchscreen: wm97xx-core: Fix possible null-pointer dereferences in wm97xx_ts_input_open()
@ 2019-07-26 10:23 Jia-Ju Bai
2019-07-26 10:33 ` Charles Keepax
0 siblings, 1 reply; 2+ messages in thread
From: Jia-Ju Bai @ 2019-07-26 10:23 UTC (permalink / raw)
To: dmitry.torokhov, allison, gregkh, tglx, rdunlap
Cc: patches, linux-input, linux-kernel, Jia-Ju Bai
In wm97xx_ts_input_open(), there is an if statement on line 507 to check
whether wm->mach_ops is NULL:
if (wm->mach_ops && wm->mach_ops->acc_enabled)
When wm->mach_ops is NULL, it is used on line 521:
wm97xx_init_pen_irq(wm);
BUG_ON(!wm->mach_ops->irq_enable);
BUG_ON(!wm->mach_ops->irq_gpio);
wm97xx_reg_write(..., reg & ~(wm->mach_ops->irq_gpio))
Thus, possible null-pointer dereferences may occur.
To fix these bugs, wm->mach_ops is checked at the beginning of
wm97xx_init_pen_irq().
These bugs found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
v2:
* Add a new check of wm->mach_ops in wm97xx_init_pen_irq().
Thank Charles for helpful advice.
v3:
* Print a message if wm->mach_ops is NULL in wm97xx_init_pen_irq().
Thank Charles for helpful advice.
---
drivers/input/touchscreen/wm97xx-core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
index 0a174bd82915..bf754cb8965c 100644
--- a/drivers/input/touchscreen/wm97xx-core.c
+++ b/drivers/input/touchscreen/wm97xx-core.c
@@ -374,6 +374,11 @@ static int wm97xx_init_pen_irq(struct wm97xx *wm)
{
u16 reg;
+ if (!wm->mach_ops) {
+ dev_err(wm->dev, "mach_ops is NULL");
+ return -EINVAL;
+ }
+
/* If an interrupt is supplied an IRQ enable operation must also be
* provided. */
BUG_ON(!wm->mach_ops->irq_enable);
--
2.17.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v3] input: touchscreen: wm97xx-core: Fix possible null-pointer dereferences in wm97xx_ts_input_open()
2019-07-26 10:23 [PATCH v3] input: touchscreen: wm97xx-core: Fix possible null-pointer dereferences in wm97xx_ts_input_open() Jia-Ju Bai
@ 2019-07-26 10:33 ` Charles Keepax
0 siblings, 0 replies; 2+ messages in thread
From: Charles Keepax @ 2019-07-26 10:33 UTC (permalink / raw)
To: Jia-Ju Bai
Cc: dmitry.torokhov, allison, gregkh, tglx, rdunlap, patches,
linux-input, linux-kernel
On Fri, Jul 26, 2019 at 06:23:26PM +0800, Jia-Ju Bai wrote:
> In wm97xx_ts_input_open(), there is an if statement on line 507 to check
> whether wm->mach_ops is NULL:
> if (wm->mach_ops && wm->mach_ops->acc_enabled)
>
> When wm->mach_ops is NULL, it is used on line 521:
> wm97xx_init_pen_irq(wm);
> BUG_ON(!wm->mach_ops->irq_enable);
> BUG_ON(!wm->mach_ops->irq_gpio);
> wm97xx_reg_write(..., reg & ~(wm->mach_ops->irq_gpio))
>
> Thus, possible null-pointer dereferences may occur.
>
> To fix these bugs, wm->mach_ops is checked at the beginning of
> wm97xx_init_pen_irq().
>
> These bugs found by a static analysis tool STCheck written by us.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
> ---
> v2:
> * Add a new check of wm->mach_ops in wm97xx_init_pen_irq().
> Thank Charles for helpful advice.
>
> v3:
> * Print a message if wm->mach_ops is NULL in wm97xx_init_pen_irq().
> Thank Charles for helpful advice.
>
> ---
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Thanks,
Charles
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-07-26 10:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-26 10:23 [PATCH v3] input: touchscreen: wm97xx-core: Fix possible null-pointer dereferences in wm97xx_ts_input_open() Jia-Ju Bai
2019-07-26 10:33 ` Charles Keepax
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).