From patchwork Thu Oct 17 20:34:16 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 13840784 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 152DCD3C52C for ; Thu, 17 Oct 2024 20:36:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:MIME-Version: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=tGfGq8AYZ7Nk9tfcNf0RUEE9wnLOSE1tLqUZ0uRmdU8=; b=MVXnE6VLfldbftWgT3RgSBm4Sq be2lrgP2sXcb5KEG+0TfwbBmcKingMRhYlTugJF8BoOMX/Wx5AUJkIQXSsWA4q5avI+5nGH+e6B/B p5HjjLgNjBvftGwliBCBr4CAK5m1Lf5d5kOaeeHN14U3Enfdbr2jmvz3upjNhMb5eozfXDK+Njt7A eKcqszuBpXYdzti7mhKe/f3V5t3Mm0qJ0MzE3wiwhjthfuZk5BBJs7tai7Rc/IwyZOFfUyKm8T2dl KLmaaLASObQXy2VTVBt7FADGxhqDVWUi80cM29PLJ6ZDzitusBrwTsEs3/bGNQmWV8xlQsHcBzS4L OyWmooJA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1t1XDv-0000000G870-0oAY; Thu, 17 Oct 2024 20:35:55 +0000 Received: from mail-ej1-x633.google.com ([2a00:1450:4864:20::633]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1t1XCQ-0000000G7yh-2OV0 for linux-arm-kernel@lists.infradead.org; Thu, 17 Oct 2024 20:34:26 +0000 Received: by mail-ej1-x633.google.com with SMTP id a640c23a62f3a-a99f629a7aaso244562766b.1 for ; Thu, 17 Oct 2024 13:34:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1729197261; x=1729802061; darn=lists.infradead.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=tGfGq8AYZ7Nk9tfcNf0RUEE9wnLOSE1tLqUZ0uRmdU8=; b=ZgXHYaUtTbKj/hmsxBGRXACOv8WGNsFlwmiHNnG7wK815QYYpKkmp+Hew0AqLbs6ND if8bIn+0GSeSTfR6qg5PzqFXrVgY5liiEPKmHSbPMyUTJkzuyfW1p48WN8nQMITpstZX IWIVlYhIjDArQGkvWcapfzk7aoparna2H5Uj6zD2Dc6iVhgbTb+O3yk1Xqm/vKAvgGWb mZv6jdL1OlMi86UFjVZs4CUUiSL73bhBOEwv3vUd0v6U1lrHszkdSp3Ef7Ld+vTL2Eys gw5/IV/KbP/Dios4tyhy6iiqBebOW3DL9HbDEfogWSLH6qj2JOaD7He6zYNLn3243jak FgbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729197261; x=1729802061; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=tGfGq8AYZ7Nk9tfcNf0RUEE9wnLOSE1tLqUZ0uRmdU8=; b=Th74F3KU6tZy5cj6Tu54nmTaKHYMBleCyqVJW6+GoLfbsUyfjay3PmPhtCHGP60OwM DG9kVeHBBABCZGJ5cDEmdgWxPqXqQbs+gwz8PBwC8kr4pguWG1MS63iKIogNHRg66ve2 yQYq8pICarX2CR+mwL+zxbwnUaRxhqmAYsenFuuqbvNybl3O12S6/ro9Sin/Hn3lQPPO wvuRIPAKsjQYropI9peAbmUM9B7ew8xsjoA0B1fLCpMiK/r25tKVyQ5ptBi1SCFYqdZh soD0qo1O9XGaUdzqVPD0GIBoLXiVTd3BIG6b1WUM7c2xc5FJSLzv2Up+Zv8n34tUDuAy ijvA== X-Forwarded-Encrypted: i=1; AJvYcCWmBkqzn3zJdkKQvwm6q50kSDl2iKRqeF//pwLQ9mHtsEbdlSvjIsNUJdqfZJM1qFNjfD5yEI4wfRWUUXgoMNAU@lists.infradead.org X-Gm-Message-State: AOJu0Yzz+OjX4/LA0rt1wzIsqT74+IgoL7Y0Nz9F+O3k17+432KTbqyB BH/MzUK7o1bV89mOMld7CjLDXIM7/OYO2Bl/HxgH2CdBHxhvOQUj3CbdC6uD/gI= X-Google-Smtp-Source: AGHT+IEmgPvX1kkIRYEDJUNIKySkuA4+HXCNFKzqTi2T8I5tzNgjLRaV5zSnWNszCG4Cmi9deiEQMQ== X-Received: by 2002:a17:907:9404:b0:a99:ee26:f416 with SMTP id a640c23a62f3a-a9a4c2ef2a6mr454115166b.14.1729197260600; Thu, 17 Oct 2024 13:34:20 -0700 (PDT) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-a9a68c284dfsm9818466b.197.2024.10.17.13.34.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Oct 2024 13:34:19 -0700 (PDT) Date: Thu, 17 Oct 2024 23:34:16 +0300 From: Dan Carpenter To: Ming Qian Cc: Mirela Rabulea , Mauro Carvalho Chehab , Shawn Guo , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Hans Verkuil , TaoJiang , imx@lists.linux.dev, linux-media@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH v2 next] media: imx-jpeg: Fix potential error pointer dereference in detach_pm() Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20241017_133422_638730_0F1C1885 X-CRM114-Status: GOOD ( 14.10 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org The proble is on the first line: if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) If jpeg->pd_dev[i] is an error pointer, then passing it to pm_runtime_suspended() will lead to an Oops. The other conditions check for both error pointers and NULL, but it would be more clear to use the IS_ERR_OR_NULL() check for that. Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended before detach them") Cc: Signed-off-by: Dan Carpenter Reviewed-by: Ming Qian --- v2: The buggy patch hasn't hit Linus's tree yet, but it's destined for stable so add a stable tag to this too. drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c index d8e946aebba2..918ab12edc9e 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c @@ -2679,11 +2679,12 @@ static void mxc_jpeg_detach_pm_domains(struct mxc_jpeg_dev *jpeg) int i; for (i = 0; i < jpeg->num_domains; i++) { - if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) + if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) && + !pm_runtime_suspended(jpeg->pd_dev[i])) pm_runtime_force_suspend(jpeg->pd_dev[i]); - if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i])) + if (!IS_ERR_OR_NULL(jpeg->pd_link[i])) device_link_del(jpeg->pd_link[i]); - if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i])) + if (!IS_ERR_OR_NULL(jpeg->pd_dev[i])) dev_pm_domain_detach(jpeg->pd_dev[i], true); jpeg->pd_dev[i] = NULL; jpeg->pd_link[i] = NULL;