diff mbox series

[4.19.y-cip,1/9] memory: renesas-rpc-if: fix possible NULL pointer dereference of resource

Message ID 20240314192950.27343-2-prabhakar.mahadev-lad.rj@bp.renesas.com (mailing list archive)
State New
Headers show
Series Add RPC-IF support for RZ/G2{EHMN} | expand

Commit Message

Lad Prabhakar March 14, 2024, 7:29 p.m. UTC 
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>

commit 59e27d7c94aa02da039b000d33c304c179395801 upstream.

The platform_get_resource_byname() can return NULL which would be
immediately dereferenced by resource_size().  Instead dereference it
after validating the resource.

Addresses-Coverity: Dereference null return value
Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20210407154357.70200-1-krzysztof.kozlowski@canonical.com
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
---
 drivers/memory/renesas-rpc-if.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Pavel Machek March 14, 2024, 9:09 p.m. UTC | #1 
Hi!

> From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
> 
> commit 59e27d7c94aa02da039b000d33c304c179395801 upstream.
> 
> The platform_get_resource_byname() can return NULL which would be
> immediately dereferenced by resource_size().  Instead dereference it
> after validating the resource.

This claims to fix a bug, but it really does not. 4/9 adds a return
and that fixes the bug. I guess there's nothing that can or should be
done about it at this point.

Best regards,
								Pavel

> +++ b/drivers/memory/renesas-rpc-if.c
> @@ -192,10 +192,10 @@ int rpcif_sw_init(struct rpcif *rpc, struct device *dev)
>  	}
>  
>  	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dirmap");
> -	rpc->size = resource_size(res);
>  	rpc->dirmap = devm_ioremap_resource(&pdev->dev, res);
>  	if (IS_ERR(rpc->dirmap))
>  		rpc->dirmap = NULL;
> +	rpc->size = resource_size(res);
>  
>  	rpc->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
>  	if (IS_ERR(rpc->rstc))
diff mbox series

Patch

diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
index 5f650eb3e9e7..15bed5be96e3 100644
--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -192,10 +192,10 @@  int rpcif_sw_init(struct rpcif *rpc, struct device *dev)
 	}
 
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dirmap");
-	rpc->size = resource_size(res);
 	rpc->dirmap = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(rpc->dirmap))
 		rpc->dirmap = NULL;
+	rpc->size = resource_size(res);
 
 	rpc->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
 	if (IS_ERR(rpc->rstc))