2017-08-10 15:54:31

by Anton Vasilyev

Subject: [PATCH] dmaengine: qcom_hidma: avoid freeing an uninitialized pointer

If device_node np doesn't contain child or first child doesn't have
property "reg" then hidma_mgmt_of_populate_channels() perfoms
deallocation on uninitialized local variable res.

The patch adds res initialization by NULL.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <[email protected]>
---
drivers/dma/qcom/hidma_mgmt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c
index 5a0991b..89e36e3 100644
--- a/drivers/dma/qcom/hidma_mgmt.c
+++ b/drivers/dma/qcom/hidma_mgmt.c
@@ -354,7 +354,7 @@ static int __init hidma_mgmt_of_populate_channels(struct device_node *np)
struct platform_device_info pdevinfo;
struct of_phandle_args out_irq;
struct device_node *child;
- struct resource *res;
+ struct resource *res = NULL;
const __be32 *cell;
int ret = 0, size, i, num;
u64 addr, addr_size;
--
2.7.4

2017-08-10 16:17:53

by Sinan Kaya

Subject: Re: [PATCH] dmaengine: qcom_hidma: avoid freeing an uninitialized pointer

On 8/10/2017 11:54 AM, Anton Vasilyev wrote:
> If device_node np doesn't contain child or first child doesn't have
> property "reg" then hidma_mgmt_of_populate_channels() perfoms
> deallocation on uninitialized local variable res.
>
> The patch adds res initialization by NULL.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Anton Vasilyev <[email protected]>
> ---
> drivers/dma/qcom/hidma_mgmt.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c
> index 5a0991b..89e36e3 100644
> --- a/drivers/dma/qcom/hidma_mgmt.c
> +++ b/drivers/dma/qcom/hidma_mgmt.c
> @@ -354,7 +354,7 @@ static int __init hidma_mgmt_of_populate_channels(struct device_node *np)
> struct platform_device_info pdevinfo;
> struct of_phandle_args out_irq;
> struct device_node *child;
> - struct resource *res;
> + struct resource *res = NULL;
> const __be32 *cell;
> int ret = 0, size, i, num;
> u64 addr, addr_size;
>

Reviewed-by: Sinan Kaya <[email protected]>

--
Sinan Kaya
Qualcomm Datacenter Technologies, Inc. as an affiliate of Qualcomm Technologies, Inc.
Qualcomm Technologies, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project.

2017-08-21 16:18:24

by Vinod Koul

Subject: Re: [PATCH] dmaengine: qcom_hidma: avoid freeing an uninitialized pointer

On Thu, Aug 10, 2017 at 06:54:25PM +0300, Anton Vasilyev wrote:
> If device_node np doesn't contain child or first child doesn't have
> property "reg" then hidma_mgmt_of_populate_channels() perfoms
> deallocation on uninitialized local variable res.
>
> The patch adds res initialization by NULL.
>
> Found by Linux Driver Verification project (linuxtesting.org).

Applied, thanks

--
~Vinod