From patchwork Wed Jun 15 22:29:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Janusz Krzysztofik X-Patchwork-Id: 9179661 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 8757D604DB for ; Wed, 15 Jun 2016 22:31:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7790E27BE5 for ; Wed, 15 Jun 2016 22:31:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6C5A027DA4; Wed, 15 Jun 2016 22:31:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, HK_RANDOM_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1CEA327D5D for ; Wed, 15 Jun 2016 22:31:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161025AbcFOWa4 (ORCPT ); Wed, 15 Jun 2016 18:30:56 -0400 Received: from mail-lf0-f68.google.com ([209.85.215.68]:36684 "EHLO mail-lf0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932141AbcFOWay (ORCPT ); Wed, 15 Jun 2016 18:30:54 -0400 Received: by mail-lf0-f68.google.com with SMTP id a2so4001795lfe.3; Wed, 15 Jun 2016 15:30:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nGxljNGAz8NBmkRly81y7vT54i7YZzy+fsI7o6YF72w=; b=0nSGXPZlp42AixQ+Ra3W3zWwwcTebQ9hd8bHa31h8QPmCrmPzVQ+l+hgb2fdXL1e10 3z4yY9w1MNCw4kAyG1IHnqScn0iBYqaHN+AJFXTaw9HF8ZTkzIblBRP8lRG0KzzaViKd mFnFiHBO/4ynUY3d9Vbb34W1Yy1VnPEs7RoFwUbc89X+M7ZT0CCaVZCpMOR79ATXqbW5 HpHosSjEjCaN4nlJ2N1NWSsW0fnhPEZ9cPInRGp+ikI5C1XR1SpCwZWEh/MrtyknE+Wf 73Hy2TJqvLV3SZONtUop3VYnToqeObOOn3jj7eODWOqKBeV5CqfPcrQ/gqZbVNRwmG0A Vk7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=nGxljNGAz8NBmkRly81y7vT54i7YZzy+fsI7o6YF72w=; b=NLt3lEpKfHrWTAOTQfo/7xh8LAkyvyNCx+2O51kHU1DtyrT/okpHsIHKpZUICCb7k8 M/AHzcNJpnpgwvNgGGV28d22LWhsFN2AZX1dzKic4ybMDafZID+JQ65nMRt6e6vKwpoK rIwplJxC5U0R0jw2BzR2fSKKPhtfRva361C0WyXyqw/SH2E23J8J/k84aQEHGs/kzuFE 93C7tie4NpZIJNxmWAav0f+C4tlBW/3g4e9dFXXY7dUJnx1Ylv60zra/soWqBI4OLiCx cfD8VZAh1QL9TL/0C+H25LrCrtq5yCJeJUxq2YqQmy8nLUUoLbh9bs7zvMpgxT/spSKh 16Cg== X-Gm-Message-State: ALyK8tISEyPuqvckQzeLiCZbqu1fJOEx8Srkb1ecBdosh/RjQyKiNVVB4btuozPDLL6pSA== X-Received: by 10.25.156.83 with SMTP id f80mr304517lfe.141.1466029853013; Wed, 15 Jun 2016 15:30:53 -0700 (PDT) Received: from z50.lan (93-181-165-181.internetia.net.pl. [93.181.165.181]) by smtp.gmail.com with ESMTPSA id 139sm3925258ljj.1.2016.06.15.15.30.51 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 15 Jun 2016 15:30:52 -0700 (PDT) From: Janusz Krzysztofik To: Mauro Carvalho Chehab , Guennadi Liakhovetski , Greg Kroah-Hartman Cc: Hans Verkuil , Amitoj Kaur Chawla , Arnd Bergmann , Lee Jones , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, devel@driverdev.osuosl.org, Janusz Krzysztofik Subject: [PATCH 1/3] staging: media: omap1: fix null pointer dereference in omap1_cam_probe() Date: Thu, 16 Jun 2016 00:29:48 +0200 Message-Id: <1466029790-31094-2-git-send-email-jmkrzyszt@gmail.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1466029790-31094-1-git-send-email-jmkrzyszt@gmail.com> References: <1466029790-31094-1-git-send-email-jmkrzyszt@gmail.com> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Commit 76e543382bd4 ("staging: media: omap1: Switch to devm_ioremap_resource") moved assignment of struct resource *res = platform_get_resource() several lines down. That resulted in the following error: [ 3.793237] Unable to handle kernel NULL pointer dereference at virtual address 00000004 [ 3.802198] pgd = c0004000 [ 3.805202] [00000004] *pgd=00000000 [ 3.809373] Internal error: Oops: c5 [#1] ARM [ 3.814070] CPU: 0 PID: 1 Comm: swapper Not tainted 4.6.0-rc1+ #70 [ 3.820570] Hardware name: Amstrad E3 (Delta) [ 3.825232] task: c1819440 ti: c181e000 task.ti: c181e000 [ 3.830973] PC is at omap1_cam_probe+0x48/0x2d4 [ 3.835873] LR is at devres_add+0x20/0x28 Move the assignment back up where it was before - it is used to build an argument for a subsequent devm_kzalloc(). Also, restore the check for null value of res - it shouldn't hurt. While being at it: - follow the recently introduced convention of direct return instead of jump to return with err value assigned, - drop no longer needed res member from the definition of struct omap1_cam_dev. Created and tested on Amstrad Delta aginst Linux-4.7-rc3 Signed-off-by: Janusz Krzysztofik --- drivers/staging/media/omap1/omap1_camera.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/staging/media/omap1/omap1_camera.c b/drivers/staging/media/omap1/omap1_camera.c index 54b8dd2..dc35d30 100644 --- a/drivers/staging/media/omap1/omap1_camera.c +++ b/drivers/staging/media/omap1/omap1_camera.c @@ -158,7 +158,6 @@ struct omap1_cam_dev { int dma_ch; struct omap1_cam_platform_data *pdata; - struct resource *res; unsigned long pflags; unsigned long camexclk; @@ -1569,11 +1568,10 @@ static int omap1_cam_probe(struct platform_device *pdev) unsigned int irq; int err = 0; + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); irq = platform_get_irq(pdev, 0); - if ((int)irq <= 0) { - err = -ENODEV; - goto exit; - } + if (!res || (int)irq <= 0) + return -ENODEV; clk = devm_clk_get(&pdev->dev, "armper_ck"); if (IS_ERR(clk)) @@ -1614,7 +1612,6 @@ static int omap1_cam_probe(struct platform_device *pdev) INIT_LIST_HEAD(&pcdev->capture); spin_lock_init(&pcdev->lock); - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); base = devm_ioremap_resource(&pdev->dev, res); if (IS_ERR(base)) return PTR_ERR(base); @@ -1663,7 +1660,6 @@ static int omap1_cam_probe(struct platform_device *pdev) exit_free_dma: omap_free_dma(pcdev->dma_ch); -exit: return err; }