From patchwork Fri Apr 6 16:05:41 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin King X-Patchwork-Id: 10327211 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B5FE26053F for ; Fri, 6 Apr 2018 16:06:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A84E0295B4 for ; Fri, 6 Apr 2018 16:06:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9CFBA29414; Fri, 6 Apr 2018 16:06:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5E28F29414 for ; Fri, 6 Apr 2018 16:06:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752045AbeDFQFs (ORCPT ); Fri, 6 Apr 2018 12:05:48 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:46304 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751874AbeDFQFr (ORCPT ); Fri, 6 Apr 2018 12:05:47 -0400 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1f4Try-00072w-BR; Fri, 06 Apr 2018 16:05:42 +0000 From: Colin King To: Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe , Arnd Bergmann , Greg Kroah-Hartman , linux-integrity@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] tpm: st33zp24: check if chip is null before dereferencing Date: Fri, 6 Apr 2018 17:05:41 +0100 Message-Id: <20180406160541.8188-1-colin.king@canonical.com> X-Mailer: git-send-email 2.15.1 MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Colin Ian King Currently chip is being dereferenced by the call to dev_get_drvdata before it is being null checked, hence we have a potential null pointer dereference bug. Fix this by only dereferencing it after the null check. Detected by CoverityScan, CID#1357806 ("Dereference before null check") Fixes: 9e0d39d8a6a0 ("tpm: Remove useless priv field in struct tpm_vendor_specific") Signed-off-by: Colin Ian King --- drivers/char/tpm/st33zp24/st33zp24.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c index f95b9c75175b..476865d66a0e 100644 --- a/drivers/char/tpm/st33zp24/st33zp24.c +++ b/drivers/char/tpm/st33zp24/st33zp24.c @@ -367,7 +367,7 @@ static irqreturn_t tpm_ioserirq_handler(int irq, void *dev_id) static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf, size_t len) { - struct st33zp24_dev *tpm_dev = dev_get_drvdata(&chip->dev); + struct st33zp24_dev *tpm_dev; u32 status, i, size, ordinal; int burstcnt = 0; int ret; @@ -378,6 +378,7 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf, if (len < TPM_HEADER_SIZE) return -EBUSY; + tpm_dev = dev_get_drvdata(&chip->dev); ret = request_locality(chip); if (ret < 0) return ret;