2018-09-18 13:57:54

by Gustavo A. R. Silva

Subject: [PATCH v2] mtd: rawnand: atmel: Fix potential NULL pointer dereference

There is a potential execution path in which function
of_find_compatible_node() returns NULL. In such a case,
we end up having a NULL pointer dereference when accessing
pointer *nfc_np* in function of_clk_get().

So, we better don't take any chances and fix this by null
checking pointer *nfc_np* before calling of_clk_get().

Addresses-Coverity-ID: 1473052 ("Dereference null return value")
Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
Signed-off-by: Gustavo A. R. Silva <[email protected]>
---
Changes in v2:
- Add Fixes tag to the commit log.
- Remove blank line before null checking nfc_np.

drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
index a38633a..5bfbe97 100644
--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
+++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
@@ -2034,6 +2034,10 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
nand_np = dev->of_node;
nfc_np = of_find_compatible_node(dev->of_node, NULL,
"atmel,sama5d3-nfc");
+ if (!nfc_np) {
+ dev_err(dev, "Could not find device node for sama5d3-nfc\n");
+ return -ENODEV;
+ }

nc->clk = of_clk_get(nfc_np, 0);
if (IS_ERR(nc->clk)) {
--
2.7.4

2018-09-18 13:59:49

by Boris Brezillon

Subject: Re: [PATCH v2] mtd: rawnand: atmel: Fix potential NULL pointer dereference

On Tue, 18 Sep 2018 08:55:55 -0500
"Gustavo A. R. Silva" <[email protected]> wrote:

> There is a potential execution path in which function
> of_find_compatible_node() returns NULL. In such a case,
> we end up having a NULL pointer dereference when accessing
> pointer *nfc_np* in function of_clk_get().
>
> So, we better don't take any chances and fix this by null
> checking pointer *nfc_np* before calling of_clk_get().
>
> Addresses-Coverity-ID: 1473052 ("Dereference null return value")
> Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
> Signed-off-by: Gustavo A. R. Silva <[email protected]>

Reviewed-by: Boris Brezillon <[email protected]>

> ---
> Changes in v2:
> - Add Fixes tag to the commit log.
> - Remove blank line before null checking nfc_np.
>
> drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
> index a38633a..5bfbe97 100644
> --- a/drivers/mtd/nand/raw/atmel/nand-controller.c
> +++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
> @@ -2034,6 +2034,10 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
> nand_np = dev->of_node;
> nfc_np = of_find_compatible_node(dev->of_node, NULL,
> "atmel,sama5d3-nfc");
> + if (!nfc_np) {
> + dev_err(dev, "Could not find device node for sama5d3-nfc\n");
> + return -ENODEV;
> + }
>
> nc->clk = of_clk_get(nfc_np, 0);
> if (IS_ERR(nc->clk)) {

2018-09-19 07:45:22

by Tudor Ambarus

Subject: Re: [PATCH v2] mtd: rawnand: atmel: Fix potential NULL pointer dereference

On 09/18/2018 04:55 PM, Gustavo A. R. Silva wrote:
> There is a potential execution path in which function
> of_find_compatible_node() returns NULL. In such a case,
> we end up having a NULL pointer dereference when accessing
> pointer *nfc_np* in function of_clk_get().
>
> So, we better don't take any chances and fix this by null
> checking pointer *nfc_np* before calling of_clk_get().
>
> Addresses-Coverity-ID: 1473052 ("Dereference null return value")
> Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
> Signed-off-by: Gustavo A. R. Silva <[email protected]>

Acked-by: Tudor Ambarus <[email protected]>

> ---
> Changes in v2:
> - Add Fixes tag to the commit log.
> - Remove blank line before null checking nfc_np.
>
> drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
> index a38633a..5bfbe97 100644
> --- a/drivers/mtd/nand/raw/atmel/nand-controller.c
> +++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
> @@ -2034,6 +2034,10 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
> nand_np = dev->of_node;
> nfc_np = of_find_compatible_node(dev->of_node, NULL,
> "atmel,sama5d3-nfc");
> + if (!nfc_np) {
> + dev_err(dev, "Could not find device node for sama5d3-nfc\n");
> + return -ENODEV;
> + }
>
> nc->clk = of_clk_get(nfc_np, 0);
> if (IS_ERR(nc->clk)) {
>

2018-09-19 21:28:14

by Miquel Raynal

Subject: Re: [PATCH v2] mtd: rawnand: atmel: Fix potential NULL pointer dereference

Hi Gustavo,

"Gustavo A. R. Silva" <[email protected]> wrote on Tue, 18 Sep
2018 08:55:55 -0500:

> There is a potential execution path in which function
> of_find_compatible_node() returns NULL. In such a case,
> we end up having a NULL pointer dereference when accessing
> pointer *nfc_np* in function of_clk_get().
>
> So, we better don't take any chances and fix this by null
> checking pointer *nfc_np* before calling of_clk_get().
>
> Addresses-Coverity-ID: 1473052 ("Dereference null return value")
> Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver")
> Signed-off-by: Gustavo A. R. Silva <[email protected]>
> ---

Applied to nand/next.

Thanks,
Miquèl