From patchwork Sun Jul 9 19:42:19 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Scheller X-Patchwork-Id: 9832009 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3D45960317 for ; Sun, 9 Jul 2017 19:42:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2C5B6274D0 for ; Sun, 9 Jul 2017 19:42:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 20E9C27FB7; Sun, 9 Jul 2017 19:42:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C4282274D0 for ; Sun, 9 Jul 2017 19:42:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752653AbdGITmr (ORCPT ); Sun, 9 Jul 2017 15:42:47 -0400 Received: from mail-wr0-f194.google.com ([209.85.128.194]:33756 "EHLO mail-wr0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752630AbdGITmi (ORCPT ); Sun, 9 Jul 2017 15:42:38 -0400 Received: by mail-wr0-f194.google.com with SMTP id x23so20430659wrb.0 for ; Sun, 09 Jul 2017 12:42:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=ydVWIq8sTmjt/HvIyWXovwpHCyy2i1h7G8H8vE0NZOQ=; b=ptbljgaEvEBRfq8kfwuE2UNsoZ7FUaFhTxAeGLQG5lNmdw1Qok4e9YNgw+BPN9Y0CC eZyabgxF3hsLiksi7GSJW3KxTHOUB4h8oslYrD17iZK/I9ak3Xcw9wiFjqKS5kUzXiCn FlxV1phyQAI0w3QGkUFCLxBdkvR8BaOg2j9B9RDcNGl0aufTEucqxLviZc4G/RFasiz4 d3VQ3Ylml1dP+/d+FAGxm5lGUI7VZn2QdhVGPkqeYRIc5EZyDxQq456Ovs53NqRnKwDr muLb0D5bmuSM7J8YlzhhlXqvr5sB3fcjX8xUSRZr78upmHHZFy68goqIH5DFl/+c/gOq eLJg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=ydVWIq8sTmjt/HvIyWXovwpHCyy2i1h7G8H8vE0NZOQ=; b=qaConPukmSwzl+nAyrZ+T70Ba+wJVgM8LCHMSzyB8Z/FQJeJivIYkUYSa1MPeNREW5 aRC65FG5c9Iyowdhj10AuLQM3cOf42GJTpud6TpD1cFCnQiWLt63vfOX1r4C/4gZqeyo z3EzPm0crN1dTiomzdDWUP1VqqLf6IdWvz8U5K1x6U3GRLHLUEPgmjGNU1kIa4Q5vmEm qvHztXFY4exZ+YS9jgEwmRaFlShymBpkgdEbMDUh88/JpUTXSpO9z1IdYythw6vmPoXU enaJaMUmyI9cjT4kcNTbRLFks8OyETCURT7JSfqz1bKvTQkmdFTjKztSuMf4ojS33ih0 hX0w== X-Gm-Message-State: AIVw1130O+KiBvsJVK2xkYmTjq9kdSaUZ4B/kkGCGUXNJxecoiT81TDZ 9mTeCrzaOCAZcwR7 X-Received: by 10.223.135.68 with SMTP id 4mr6190790wrz.141.1499629356591; Sun, 09 Jul 2017 12:42:36 -0700 (PDT) Received: from dvbdev.wuest.de (ip-37-24-178-151.hsi14.unitymediagroup.de. [37.24.178.151]) by smtp.gmail.com with ESMTPSA id f45sm18129346wrf.2.2017.07.09.12.42.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 09 Jul 2017 12:42:36 -0700 (PDT) From: Daniel Scheller To: linux-media@vger.kernel.org, mchehab@kernel.org, mchehab@s-opensource.com Cc: jasmin@anw.at, d_spingler@gmx.de, rjkm@metzlerbros.de Subject: [PATCH 12/14] [media] ddbridge: fix dereference before check Date: Sun, 9 Jul 2017 21:42:19 +0200 Message-Id: <20170709194221.10255-13-d.scheller.oss@gmail.com> X-Mailer: git-send-email 2.13.0 In-Reply-To: <20170709194221.10255-1-d.scheller.oss@gmail.com> References: <20170709194221.10255-1-d.scheller.oss@gmail.com> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Daniel Scheller Both ts_release() and ts_open() can use "output" before check (smatch): drivers/media/pci/ddbridge/ddbridge-core.c:816 ts_release() warn: variable dereferenced before check 'output' (see line 809) drivers/media/pci/ddbridge/ddbridge-core.c:836 ts_open() warn: variable dereferenced before check 'output' (see line 828) Fix by performing checks on those pointers. Cc: Ralph Metzler Signed-off-by: Daniel Scheller --- drivers/media/pci/ddbridge/ddbridge-core.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/media/pci/ddbridge/ddbridge-core.c b/drivers/media/pci/ddbridge/ddbridge-core.c index 6896cd1f3a96..ff87e0462c7e 100644 --- a/drivers/media/pci/ddbridge/ddbridge-core.c +++ b/drivers/media/pci/ddbridge/ddbridge-core.c @@ -738,8 +738,13 @@ static unsigned int ts_poll(struct file *file, poll_table *wait) static int ts_release(struct inode *inode, struct file *file) { struct dvb_device *dvbdev = file->private_data; - struct ddb_output *output = dvbdev->priv; - struct ddb_input *input = output->port->input[0]; + struct ddb_output *output = NULL; + struct ddb_input *input = NULL; + + if (dvbdev) { + output = dvbdev->priv; + input = output->port->input[0]; + } if ((file->f_flags & O_ACCMODE) == O_RDONLY) { if (!input) @@ -757,8 +762,13 @@ static int ts_open(struct inode *inode, struct file *file) { int err; struct dvb_device *dvbdev = file->private_data; - struct ddb_output *output = dvbdev->priv; - struct ddb_input *input = output->port->input[0]; + struct ddb_output *output = NULL; + struct ddb_input *input = NULL; + + if (dvbdev) { + output = dvbdev->priv; + input = output->port->input[0]; + } if ((file->f_flags & O_ACCMODE) == O_RDONLY) { if (!input)