From: Shuah Khan <shuah.kh@samsung.com>
To: m.chehab@samsung.com
Cc: Shuah Khan <shuah.kh@samsung.com>,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
shuahkhan@gmail.com
Subject: [PATCH 3/3] media/drx39xyj: fix boot failure due to null pointer dereference
Date: Fri, 28 Feb 2014 14:23:02 -0700 [thread overview]
Message-ID: <d3568a908a443ba07681636452c79a070cf05118.1393621530.git.shuah.kh@samsung.com> (raw)
In-Reply-To: <cover.1393621530.git.shuah.kh@samsung.com>
In-Reply-To: <cover.1393621530.git.shuah.kh@samsung.com>
DJH_DEBUG only code path in drxbsp_i2c_write_read() dereferences
w_dev_addr and subsequently w_dev_addr->user_data->i2c which results
in failure during boot. This patch fixes the null pointer derefence
bug as well as the following compile errors:
LD arch/x86/built-in.o
CC drivers/media/dvb-frontends/drx39xyj/drxj.o
drivers/media/dvb-frontends/drx39xyj/drxj.c: In function ‘drxbsp_i2c_write_read’:
drivers/media/dvb-frontends/drx39xyj/drxj.c:1558:25: error: redeclaration of ‘state’ with no linkage
struct drx39xxj_state *state = w_dev_addr->user_data;
^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1512:25: note: previous declaration of ‘state’ was here
struct drx39xxj_state *state;
^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1558:2: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
struct drx39xxj_state *state = w_dev_addr->user_data;
^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1560:17: error: redeclaration of ‘msg’ with no linkage
struct i2c_msg msg[2] = {
^
drivers/media/dvb-frontends/drx39xyj/drxj.c:1513:17: note: previous declaration of ‘msg’ was here
struct i2c_msg msg[2];
^
Signed-off-by: Shuah Khan <shuah.kh@samsung.com>
---
drivers/media/dvb-frontends/drx39xyj/drxj.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/drivers/media/dvb-frontends/drx39xyj/drxj.c b/drivers/media/dvb-frontends/drx39xyj/drxj.c
index 72c541a..585d891 100644
--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
+++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
@@ -1551,14 +1551,23 @@ int drxbsp_i2c_write_read(struct i2c_device_addr *w_dev_addr,
}
#ifdef DJH_DEBUG
- struct drx39xxj_state *state = w_dev_addr->user_data;
+ if (w_dev_addr == NULL || r_dev_addr == NULL)
+ return 0;
- struct i2c_msg msg[2] = {
- {.addr = w_dev_addr->i2c_addr,
- .flags = 0, .buf = wData, .len = w_count},
- {.addr = r_dev_addr->i2c_addr,
- .flags = I2C_M_RD, .buf = r_data, .len = r_count},
- };
+ state = w_dev_addr->user_data;
+
+ if (state->i2c == NULL)
+ return 0;
+
+ msg[0].addr = w_dev_addr->i2c_addr;
+ msg[0].flags = 0;
+ msg[0].buf = wData;
+ msg[0].len = w_count;
+ msg[1].addr = r_dev_addr->i2c_addr;
+ msg[1].flags = I2C_M_RD;
+ msg[1].buf = r_data;
+ msg[1].len = r_count;
+ num_msgs = 2;
pr_debug("drx3933 i2c operation addr=%x i2c=%p, wc=%x rc=%x\n",
w_dev_addr->i2c_addr, state->i2c, w_count, r_count);
--
1.8.3.2
next prev parent reply other threads:[~2014-02-28 21:23 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-02-28 21:22 [PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors Shuah Khan
2014-02-28 21:23 ` [PATCH 1/3] media/drx39xyj: fix pr_dbg undefined compile errors when DJH_DEBUG is defined Shuah Khan
2014-02-28 21:23 ` [PATCH 2/3] media/drx39xyj: remove return that prevents DJH_DEBUG code to run Shuah Khan
2014-02-28 21:23 ` Shuah Khan [this message]
2014-03-01 0:15 ` [PATCH 0/3] media/drx39xyj: fix DJH_DEBUG path null pointer dereferences, and compile errors Devin Heitmueller
[not found] ` <CAGoCfiyZr2eCCW3ZmAE4_YUZw++NC3o-VY84M+n38tzfLdfBiQ@mail.gmail.com>
2014-03-01 3:27 ` Shuah Khan
2014-03-01 10:57 ` Mauro Carvalho Chehab
2014-03-02 15:41 ` Mauro Carvalho Chehab
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d3568a908a443ba07681636452c79a070cf05118.1393621530.git.shuah.kh@samsung.com \
--to=shuah.kh@samsung.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=m.chehab@samsung.com \
--cc=shuahkhan@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).