2022-03-31 03:52:31

by Won Chung

Subject: [PATCH v2] misc/mei: Add NULL check to component match callback functions

Component match callback functions need to check if expected data is
passed to them. Without this check, it can cause a NULL pointer
dereference when another driver registers a component before i915
drivers have their component master fully bind.

Fixes: 1e8d19d9b0dfc ("mei: hdcp: bind only with i915 on the same PCH")
Fixes: c2004ce99ed73 ("mei: pxp: export pavp client to me client bus")
Signed-off-by: Heikki Krogerus <[email protected]>
Signed-off-by: Mika Westerberg <[email protected]>
Signed-off-by: Won Chung <[email protected]>
---
Changes from v1:
- Add "Fixes" tag
- Send to [email protected]

drivers/misc/mei/hdcp/mei_hdcp.c | 2 +-
drivers/misc/mei/pxp/mei_pxp.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c
index ec2a4fce8581..843dbc2b21b1 100644
--- a/drivers/misc/mei/hdcp/mei_hdcp.c
+++ b/drivers/misc/mei/hdcp/mei_hdcp.c
@@ -784,7 +784,7 @@ static int mei_hdcp_component_match(struct device *dev, int subcomponent,
{
struct device *base = data;

- if (strcmp(dev->driver->name, "i915") ||
+ if (!base || !dev->driver || strcmp(dev->driver->name, "i915") ||
subcomponent != I915_COMPONENT_HDCP)
return 0;

diff --git a/drivers/misc/mei/pxp/mei_pxp.c b/drivers/misc/mei/pxp/mei_pxp.c
index f7380d387bab..e32a81da8af6 100644
--- a/drivers/misc/mei/pxp/mei_pxp.c
+++ b/drivers/misc/mei/pxp/mei_pxp.c
@@ -131,7 +131,7 @@ static int mei_pxp_component_match(struct device *dev, int subcomponent,
{
struct device *base = data;

- if (strcmp(dev->driver->name, "i915") ||
+ if (!base || !dev->driver || strcmp(dev->driver->name, "i915") ||
subcomponent != I915_COMPONENT_PXP)
return 0;

--
2.35.1.1021.g381101b075-goog

2022-03-31 04:10:33

by Won Chung

Subject: Re: [PATCH v2] misc/mei: Add NULL check to component match callback functions

On Wed, Mar 30, 2022 at 1:48 PM Won Chung <[email protected]> wrote:
>
> Component match callback functions need to check if expected data is
> passed to them. Without this check, it can cause a NULL pointer
> dereference when another driver registers a component before i915
> drivers have their component master fully bind.
>
> Fixes: 1e8d19d9b0dfc ("mei: hdcp: bind only with i915 on the same PCH")
> Fixes: c2004ce99ed73 ("mei: pxp: export pavp client to me client bus")
> Signed-off-by: Heikki Krogerus <[email protected]>
> Signed-off-by: Mika Westerberg <[email protected]>
> Signed-off-by: Won Chung <[email protected]>
> ---
> Changes from v1:
> - Add "Fixes" tag
> - Send to [email protected]
>
> drivers/misc/mei/hdcp/mei_hdcp.c | 2 +-
> drivers/misc/mei/pxp/mei_pxp.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/misc/mei/hdcp/mei_hdcp.c b/drivers/misc/mei/hdcp/mei_hdcp.c
> index ec2a4fce8581..843dbc2b21b1 100644
> --- a/drivers/misc/mei/hdcp/mei_hdcp.c
> +++ b/drivers/misc/mei/hdcp/mei_hdcp.c
> @@ -784,7 +784,7 @@ static int mei_hdcp_component_match(struct device *dev, int subcomponent,
> {
> struct device *base = data;
>
> - if (strcmp(dev->driver->name, "i915") ||
> + if (!base || !dev->driver || strcmp(dev->driver->name, "i915") ||
> subcomponent != I915_COMPONENT_HDCP)
> return 0;
>
> diff --git a/drivers/misc/mei/pxp/mei_pxp.c b/drivers/misc/mei/pxp/mei_pxp.c
> index f7380d387bab..e32a81da8af6 100644
> --- a/drivers/misc/mei/pxp/mei_pxp.c
> +++ b/drivers/misc/mei/pxp/mei_pxp.c
> @@ -131,7 +131,7 @@ static int mei_pxp_component_match(struct device *dev, int subcomponent,
> {
> struct device *base = data;
>
> - if (strcmp(dev->driver->name, "i915") ||
> + if (!base || !dev->driver || strcmp(dev->driver->name, "i915") ||
> subcomponent != I915_COMPONENT_PXP)
> return 0;
>
> --
> 2.35.1.1021.g381101b075-goog
>

Hi,

I am resending this patch to correct email account.
Sorry for confusion.

Thanks,
Won