2019-03-19 00:21:55

by Aditya Pakki

Subject: [PATCH] mmc: dw_mmc: Fix to avoid potential NULL pointer dereference

of_match_node can fail and return NULL in case no matching structure.
The patches checks for such a scenario and returns -ENXIO.

Signed-off-by: Aditya Pakki <[email protected]>
---
drivers/mmc/host/dw_mmc-exynos.c | 2 ++
drivers/mmc/host/dw_mmc-k3.c | 2 ++
drivers/mmc/host/dw_mmc-pltfm.c | 2 ++
3 files changed, 6 insertions(+)

diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
index d46c3439b508..8a75d7314606 100644
--- a/drivers/mmc/host/dw_mmc-exynos.c
+++ b/drivers/mmc/host/dw_mmc-exynos.c
@@ -554,6 +554,8 @@ static int dw_mci_exynos_probe(struct platform_device *pdev)
int ret;

match = of_match_node(dw_mci_exynos_match, pdev->dev.of_node);
+ if (!match)
+ return -ENXIO;
drv_data = match->data;

pm_runtime_get_noresume(&pdev->dev);
diff --git a/drivers/mmc/host/dw_mmc-k3.c b/drivers/mmc/host/dw_mmc-k3.c
index 89cdb3d533bb..cc50b7546a20 100644
--- a/drivers/mmc/host/dw_mmc-k3.c
+++ b/drivers/mmc/host/dw_mmc-k3.c
@@ -459,6 +459,8 @@ static int dw_mci_k3_probe(struct platform_device *pdev)
const struct of_device_id *match;

match = of_match_node(dw_mci_k3_match, pdev->dev.of_node);
+ if (!match)
+ return -ENXIO;
drv_data = match->data;

return dw_mci_pltfm_register(pdev, drv_data);
diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
index 58c13e21bd5a..b1948989f617 100644
--- a/drivers/mmc/host/dw_mmc-pltfm.c
+++ b/drivers/mmc/host/dw_mmc-pltfm.c
@@ -82,6 +82,8 @@ static int dw_mci_pltfm_probe(struct platform_device *pdev)

if (pdev->dev.of_node) {
match = of_match_node(dw_mci_pltfm_match, pdev->dev.of_node);
+ if (!match)
+ return -ENXIO;
drv_data = match->data;
}

--
2.17.1

2019-03-19 00:44:26

by Shawn Lin

Subject: Re: [PATCH] mmc: dw_mmc: Fix to avoid potenti al NULL pointer dereference【请注意，邮件由[email protected]代发】

On 2019/3/19 8:19, Aditya Pakki wrote:
> of_match_node can fail and return NULL in case no matching structure.
> The patches checks for such a scenario and returns -ENXIO.
>
> Signed-off-by: Aditya Pakki <[email protected]>
> ---
> drivers/mmc/host/dw_mmc-exynos.c | 2 ++
> drivers/mmc/host/dw_mmc-k3.c | 2 ++
> drivers/mmc/host/dw_mmc-pltfm.c | 2 ++
> 3 files changed, 6 insertions(+)
>

Could you check dw_mmc-zx.c and dw_mmc-rockchip.c as well?

> diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
> index d46c3439b508..8a75d7314606 100644
> --- a/drivers/mmc/host/dw_mmc-exynos.c
> +++ b/drivers/mmc/host/dw_mmc-exynos.c
> @@ -554,6 +554,8 @@ static int dw_mci_exynos_probe(struct platform_device *pdev)
> int ret;
>
> match = of_match_node(dw_mci_exynos_match, pdev->dev.of_node);
> + if (!match)
> + return -ENXIO;
> drv_data = match->data;
>
> pm_runtime_get_noresume(&pdev->dev);
> diff --git a/drivers/mmc/host/dw_mmc-k3.c b/drivers/mmc/host/dw_mmc-k3.c
> index 89cdb3d533bb..cc50b7546a20 100644
> --- a/drivers/mmc/host/dw_mmc-k3.c
> +++ b/drivers/mmc/host/dw_mmc-k3.c
> @@ -459,6 +459,8 @@ static int dw_mci_k3_probe(struct platform_device *pdev)
> const struct of_device_id *match;
>
> match = of_match_node(dw_mci_k3_match, pdev->dev.of_node);
> + if (!match)
> + return -ENXIO;
> drv_data = match->data;
>
> return dw_mci_pltfm_register(pdev, drv_data);
> diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
> index 58c13e21bd5a..b1948989f617 100644
> --- a/drivers/mmc/host/dw_mmc-pltfm.c
> +++ b/drivers/mmc/host/dw_mmc-pltfm.c
> @@ -82,6 +82,8 @@ static int dw_mci_pltfm_probe(struct platform_device *pdev)
>
> if (pdev->dev.of_node) {
> match = of_match_node(dw_mci_pltfm_match, pdev->dev.of_node);
> + if (!match)
> + return -ENXIO;
> drv_data = match->data;
> }
>
>