of_match_device could return NULL, and so cause a NULL pointer
dereference later at line 132:
priv->flags = (uintptr_t) of_id->data;
Reported-by: coverity (CID 1324141)
Signed-off-by: LABBE Corentin <[email protected]>
---
drivers/gpio/gpio-74xx-mmio.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
index 6ed7c0f..6b18682 100644
--- a/drivers/gpio/gpio-74xx-mmio.c
+++ b/drivers/gpio/gpio-74xx-mmio.c
@@ -113,13 +113,16 @@ static int mmio_74xx_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
static int mmio_74xx_gpio_probe(struct platform_device *pdev)
{
- const struct of_device_id *of_id =
- of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
+ const struct of_device_id *of_id;
struct mmio_74xx_gpio_priv *priv;
struct resource *res;
void __iomem *dat;
int err;
+ of_id = of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
+ if (!of_id)
+ return -ENODEV;
+
priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
--
2.4.10
of_match_device could return NULL, and so cause a NULL pointer
dereference later at line 199:
priv->flags = of_id->data;
Reported-by: coverity (CID 1324140)
Signed-off-by: LABBE Corentin <[email protected]>
---
drivers/gpio/gpio-syscon.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c
index 045a952..7b25fdf 100644
--- a/drivers/gpio/gpio-syscon.c
+++ b/drivers/gpio/gpio-syscon.c
@@ -187,11 +187,15 @@ MODULE_DEVICE_TABLE(of, syscon_gpio_ids);
static int syscon_gpio_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
- const struct of_device_id *of_id = of_match_device(syscon_gpio_ids, dev);
+ const struct of_device_id *of_id;
struct syscon_gpio_priv *priv;
struct device_node *np = dev->of_node;
int ret;
+ of_id = of_match_device(syscon_gpio_ids, dev);
+ if (!of_id)
+ return -ENODEV;
+
priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
--
2.4.10
of_match_device could return NULL, and so cause a NULL pointer
dereference later.
Reported-by: coverity (CID 1130700)
Signed-off-by: LABBE Corentin <[email protected]>
---
drivers/gpio/gpio-palmas.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpio/gpio-palmas.c b/drivers/gpio/gpio-palmas.c
index 171a638..52b447c 100644
--- a/drivers/gpio/gpio-palmas.c
+++ b/drivers/gpio/gpio-palmas.c
@@ -167,6 +167,8 @@ static int palmas_gpio_probe(struct platform_device *pdev)
const struct palmas_device_data *dev_data;
match = of_match_device(of_palmas_gpio_match, &pdev->dev);
+ if (!match)
+ return -ENODEV;
dev_data = match->data;
if (!dev_data)
dev_data = &palmas_dev_data;
--
2.4.10
On Wed, Nov 11, 2015 at 9:27 PM, LABBE Corentin
<[email protected]> wrote:
> of_match_device could return NULL, and so cause a NULL pointer
> dereference later at line 132:
> priv->flags = (uintptr_t) of_id->data;
>
> Reported-by: coverity (CID 1324141)
> Signed-off-by: LABBE Corentin <[email protected]>
Patch applied.
Yours,
Linus Walleij
On Wed, Nov 11, 2015 at 9:27 PM, LABBE Corentin
<[email protected]> wrote:
> of_match_device could return NULL, and so cause a NULL pointer
> dereference later at line 199:
> priv->flags = of_id->data;
>
> Reported-by: coverity (CID 1324140)
> Signed-off-by: LABBE Corentin <[email protected]>
Took out the previously applied version and applied this instead.
Yours,
Linus Walleij
On Wed, Nov 11, 2015 at 9:27 PM, LABBE Corentin
<[email protected]> wrote:
> of_match_device could return NULL, and so cause a NULL pointer
> dereference later.
>
> Reported-by: coverity (CID 1130700)
> Signed-off-by: LABBE Corentin <[email protected]>
Patch applied.
ALl of these seem pretty academic, as the match table is likely
the same that causes the device core to call probe() in the
first place. But whatever.
Yours,
Linus Walleij
On Wed, Nov 11, 2015 at 9:27 PM, LABBE Corentin
<[email protected]> wrote:
> of_match_device could return NULL, and so cause a NULL pointer
> dereference later at line 132:
> priv->flags = (uintptr_t) of_id->data;
>
> Reported-by: coverity (CID 1324141)
This is a DT-only driver, hence this cannot happen?
> Signed-off-by: LABBE Corentin <[email protected]>
> ---
> drivers/gpio/gpio-74xx-mmio.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
> index 6ed7c0f..6b18682 100644
> --- a/drivers/gpio/gpio-74xx-mmio.c
> +++ b/drivers/gpio/gpio-74xx-mmio.c
> @@ -113,13 +113,16 @@ static int mmio_74xx_dir_out(struct gpio_chip *gc, unsigned int gpio, int val)
>
> static int mmio_74xx_gpio_probe(struct platform_device *pdev)
> {
> - const struct of_device_id *of_id =
> - of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
> + const struct of_device_id *of_id;
> struct mmio_74xx_gpio_priv *priv;
> struct resource *res;
> void __iomem *dat;
> int err;
>
> + of_id = of_match_device(mmio_74xx_gpio_ids, &pdev->dev);
> + if (!of_id)
> + return -ENODEV;
> +
> priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
> if (!priv)
> return -ENOMEM;
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- [email protected]
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Fri, Nov 20, 2015 at 10:22 AM, Geert Uytterhoeven
<[email protected]> wrote:
> On Wed, Nov 11, 2015 at 9:27 PM, LABBE Corentin
> <[email protected]> wrote:
>> of_match_device could return NULL, and so cause a NULL pointer
>> dereference later at line 132:
>> priv->flags = (uintptr_t) of_id->data;
>>
>> Reported-by: coverity (CID 1324141)
>
> This is a DT-only driver, hence this cannot happen?
Yeah I said the same in comment to some other patch in the
series. But it doesn't hurt much either. Coccinelle has no clue
about deeper semantics, just shallow semantics.
Yours,
Linus Walleij