2010-02-14 15:52:52

by Roel Kluin

[permalink] [raw]
Subject: [PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

Don't dereference autodep when it's NULL. In _autodep_lookup() an
ERR_PTR(-ENOENT) is assigned to autodep->pwrdm.ptr if pwrdm_lookup() fails.

Signed-off-by: Roel Kluin <[email protected]>
---

Alternatively we could do:

- for (autodep = autodeps; autodep->pwrdm.ptr; autodep++)
+ for (autodep = autodeps; !IS_ERR(autodep->pwrdm.ptr); autodep++)

...but considering how _clkdm_add_autodeps() traverses trough the autodeps it
appears that we want to ignore failures. Correct?

Roel

diff --git a/arch/arm/mach-omap2/clockdomain.c b/arch/arm/mach-omap2/clockdomain.c
index dd285f0..8f359c1 100644
--- a/arch/arm/mach-omap2/clockdomain.c
+++ b/arch/arm/mach-omap2/clockdomain.c
@@ -64,9 +64,6 @@ static void _autodep_lookup(struct clkdm_pwrdm_autodep *autodep)
{
struct powerdomain *pwrdm;

- if (!autodep)
- return;
-
if (!omap_chip_is(autodep->omap_chip))
return;

@@ -211,7 +208,7 @@ void clkdm_init(struct clockdomain **clkdms,

autodeps = init_autodeps;
if (autodeps)
- for (autodep = autodeps; autodep->pwrdm.ptr; autodep++)
+ for (autodep = autodeps; autodep; autodep++)
_autodep_lookup(autodep);
}


2010-02-14 16:41:28

by Roel Kluin

[permalink] [raw]
Subject: Re: [PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

Op 14-02-10 17:00, Roel Kluin schreef:
> Don't dereference autodep when it's NULL. In _autodep_lookup() an
> ERR_PTR(-ENOENT) is assigned to autodep->pwrdm.ptr if pwrdm_lookup() fails.

I am not sure whether my patch was right, if indeed a dereference, then it
appears to also occur in _clkdm_add_autodeps() and _clkdm_del_autodeps().

Roel

2010-02-22 21:06:28

by Paul Walmsley

[permalink] [raw]
Subject: Re: [PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

Hi Roel,

On Sun, 14 Feb 2010, Roel Kluin wrote:

> Don't dereference autodep when it's NULL. In _autodep_lookup() an
> ERR_PTR(-ENOENT) is assigned to autodep->pwrdm.ptr if pwrdm_lookup() fails.
>
> Signed-off-by: Roel Kluin <[email protected]>

Thanks for the patch, but I don't understand what problem you're
pointing out. If autodeps is NULL entering clkdm_init(), then the
for-loop won't even be entered.

It looks like there may be a problem, however, in _clkdm_add_autodeps()
and _clkdm_del_autodeps() if no autodeps were passed in. What do you
think about something like the following instead?


- Paul


From: Paul Walmsley <[email protected]>
Date: Mon, 22 Feb 2010 14:01:45 -0700
Subject: [PATCH] OMAP clockdomain: if no autodeps exist, don't try to add or remove them

_clkdm_add_autodeps() and _clkdm_del_autodeps() will attempt to dereference
a NULL pointer if no autodeps were supplied to clkdm_init().

Based on a patch from Roel Kluin <[email protected]> - thanks Roel.

Signed-off-by: Paul Walmsley <[email protected]>
Cc: Roel Kluin <[email protected]>
---
arch/arm/mach-omap2/clockdomain.c | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/arch/arm/mach-omap2/clockdomain.c b/arch/arm/mach-omap2/clockdomain.c
index de4278c..b26d30a 100644
--- a/arch/arm/mach-omap2/clockdomain.c
+++ b/arch/arm/mach-omap2/clockdomain.c
@@ -173,6 +173,9 @@ static void _clkdm_add_autodeps(struct clockdomain *clkdm)
{
struct clkdm_autodep *autodep;

+ if (!autodeps)
+ return;
+
for (autodep = autodeps; autodep->clkdm.ptr; autodep++) {
if (IS_ERR(autodep->clkdm.ptr))
continue;
@@ -201,6 +204,9 @@ static void _clkdm_del_autodeps(struct clockdomain *clkdm)
{
struct clkdm_autodep *autodep;

+ if (!autodeps)
+ return;
+
for (autodep = autodeps; autodep->clkdm.ptr; autodep++) {
if (IS_ERR(autodep->clkdm.ptr))
continue;
--
1.6.6.GIT

2010-02-24 22:24:48

by Roel Kluin

[permalink] [raw]
Subject: Re: [PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

> Thanks for the patch, but I don't understand what problem you're
> pointing out.  If autodeps is NULL entering clkdm_init(), then the
> for-loop won't even be entered.

My first patch was wrong, but there's something I think could
be wrong. In clkdm_init() we have:

for (autodep = autodeps; autodep->pwrdm.ptr; autodep++)
_autodep_lookup(autodep);

In _autodep_lookup() we ensure that we don't dereference
autodep by:

if (!autodep)
return;

but if autodep can be NULL we already dereferenced it in
the aforementioned for loop, so shouldn't that be:

for (autodep = autodeps; autodep && autodep->pwrdm.ptr; autodep++)
_autodep_lookup(autodep);

Then since this is the only call to _autodep_lookup() we can remove
that test there. Do you agree?

> It looks like there may be a problem, however, in _clkdm_add_autodeps()
> and _clkdm_del_autodeps() if no autodeps were passed in.  What do you
> think about something like the following instead?
>
>
> - Paul

Your suggested patch looks right to me as well.