From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
To: David.Laight@ACULAB.COM, damien.lemoal@opensource.wdc.com,
davem@davemloft.net
Cc: linux-ide@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org, Jiasheng Jiang <jiasheng@iscas.ac.cn>
Subject: [PATCH v3] ide: Check for null pointer after calling devm_ioremap
Date: Fri, 7 Jan 2022 19:50:00 +0800 [thread overview]
Message-ID: <20220107115000.4057454-1-jiasheng@iscas.ac.cn> (raw)
In linux-stable-5.15.13, this file has been removed and combined
to `drivers/ata/pata_platform.c` without this bug.
But in the older LTS kernels, like 5.10.90, this bug still exists.
As the possible failure of the devres_alloc(), the devm_ioremap() and
devm_ioport_map() may return NULL pointer.
And then, the 'base' and 'alt_base' are used in plat_ide_setup_ports().
Therefore, it should be better to add the check in order to avoid the
dereference of the NULL pointer.
Actually, it introduced the bug from commit 8cb1f567f4c0
("ide: Platform IDE driver") and we can know from the commit message
that it tended to be similar to the `drivers/ata/pata_platform.c`.
But actually, even the first time pata_platform was built,
commit a20c9e820864 ("[PATCH] ata: Generic platform_device libata driver"),
there was no the bug, as there was a check after the ioremap().
So possibly the bug was caused by ide itself.
Fixes: 8cb1f567f4c0 ("ide: Platform IDE driver")
Cc: stable@vger.kernel.org#5.10.90
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
---
Changelog
v2 -> v3
* Change 1. Correct the fixes tag and commit message.
* Change 2. Correct the code.
---
drivers/ide/ide_platform.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/ide/ide_platform.c b/drivers/ide/ide_platform.c
index 91639fd6c276..5500c5afb3ca 100644
--- a/drivers/ide/ide_platform.c
+++ b/drivers/ide/ide_platform.c
@@ -85,6 +85,10 @@ static int plat_ide_probe(struct platform_device *pdev)
alt_base = devm_ioport_map(&pdev->dev,
res_alt->start, resource_size(res_alt));
}
+ if (!base || !alt_base) {
+ ret = -ENOMEM;
+ goto out;
+ }
memset(&hw, 0, sizeof(hw));
plat_ide_setup_ports(&hw, base, alt_base, pdata, res_irq->start);
--
2.25.1
next reply other threads:[~2022-01-07 11:50 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-07 11:50 Jiasheng Jiang [this message]
2022-01-07 12:07 ` [PATCH v3] ide: Check for null pointer after calling devm_ioremap Damien Le Moal
2022-01-07 12:53 Jiasheng Jiang
2022-01-08 2:53 ` Damien Le Moal
2022-01-08 3:55 Jiasheng Jiang
2022-01-09 8:53 ` Damien Le Moal
2022-01-09 14:01 Jiasheng Jiang
2022-01-11 2:23 ` Naohiro Aota
2022-01-11 3:01 Jiasheng Jiang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220107115000.4057454-1-jiasheng@iscas.ac.cn \
--to=jiasheng@iscas.ac.cn \
--cc=David.Laight@ACULAB.COM \
--cc=damien.lemoal@opensource.wdc.com \
--cc=davem@davemloft.net \
--cc=linux-ide@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).