diff mbox series

media: s5p-mfc: fix incorrect bus assignment in virtual child device

Message ID 20190107120414.30622-1-m.szyprowski@samsung.com (mailing list archive)
State New, archived
Headers show
Series media: s5p-mfc: fix incorrect bus assignment in virtual child device | expand

Commit Message

Marek Szyprowski Jan. 7, 2019, 12:04 p.m. UTC
Virtual MFC codec's child devices must not be assigned to platform bus,
because they are allocated as raw 'struct device' and don't have the
corresponding 'platform' part. This fixes NULL pointer access revealed
recently by commit a66d972465d1 ("devres: Align data[] to
ARCH_KMALLOC_MINALIGN").

Reported-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Fixes: c79667dd93b0 ("media: s5p-mfc: replace custom reserved memory handling code with generic one")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
---
 drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 -
 1 file changed, 1 deletion(-)

Comments

Paweł Chmiel Jan. 7, 2019, 3:29 p.m. UTC | #1
Dnia poniedziałek, 7 stycznia 2019 13:04:14 CET Marek Szyprowski pisze:
> Virtual MFC codec's child devices must not be assigned to platform bus,
> because they are allocated as raw 'struct device' and don't have the
> corresponding 'platform' part. This fixes NULL pointer access revealed
> recently by commit a66d972465d1 ("devres: Align data[] to
> ARCH_KMALLOC_MINALIGN").
> 
> Reported-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
> Fixes: c79667dd93b0 ("media: s5p-mfc: replace custom reserved memory handling code with generic one")
> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
> ---
>  drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
> index 927a1235408d..ca11f8a7569d 100644
> --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
> +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
> @@ -1089,7 +1089,6 @@ static struct device *s5p_mfc_alloc_memdev(struct device *dev,
>  	device_initialize(child);
>  	dev_set_name(child, "%s:%s", dev_name(dev), name);
>  	child->parent = dev;
> -	child->bus = dev->bus;
>  	child->coherent_dma_mask = dev->coherent_dma_mask;
>  	child->dma_mask = dev->dma_mask;
>  	child->release = s5p_mfc_memdev_release;
> 

Checked on Samsung Galaxy S and not it's not crashing anymore. Thanks for patch.
Tested-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
diff mbox series

Patch

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 927a1235408d..ca11f8a7569d 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1089,7 +1089,6 @@  static struct device *s5p_mfc_alloc_memdev(struct device *dev,
 	device_initialize(child);
 	dev_set_name(child, "%s:%s", dev_name(dev), name);
 	child->parent = dev;
-	child->bus = dev->bus;
 	child->coherent_dma_mask = dev->coherent_dma_mask;
 	child->dma_mask = dev->dma_mask;
 	child->release = s5p_mfc_memdev_release;