2015-11-12 07:45:28

by Corentin Labbe

[permalink] [raw]
Subject: [PATCH] usb: phy: msm: fix a possible NULL dereference

of_match_device could return NULL, and so cause a NULL pointer
dereference later. Renaming id to of_id (like all others do) in the
process.

Reported-by: coverity (CID 1324133)
Signed-off-by: LABBE Corentin <[email protected]>
---
drivers/usb/phy/phy-msm-usb.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
index 80eb991..c4a66cf 100644
--- a/drivers/usb/phy/phy-msm-usb.c
+++ b/drivers/usb/phy/phy-msm-usb.c
@@ -1506,20 +1506,23 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
{
struct msm_otg_platform_data *pdata;
struct extcon_dev *ext_id, *ext_vbus;
- const struct of_device_id *id;
+ const struct of_device_id *of_id;
struct device_node *node = pdev->dev.of_node;
struct property *prop;
int len, ret, words;
u32 val, tmp[3];

+ of_id = of_match_device(msm_otg_dt_match, &pdev->dev);
+ if (!of_id)
+ return -ENODEV;
+
pdata = devm_kzalloc(&pdev->dev, sizeof(*pdata), GFP_KERNEL);
if (!pdata)
return -ENOMEM;

motg->pdata = pdata;

- id = of_match_device(msm_otg_dt_match, &pdev->dev);
- pdata->phy_type = (enum msm_usb_phy_type) id->data;
+ pdata->phy_type = (enum msm_usb_phy_type)of_id->data;

motg->link_rst = devm_reset_control_get(&pdev->dev, "link");
if (IS_ERR(motg->link_rst))
--
2.4.10


2015-11-16 17:07:44

by Felipe Balbi

[permalink] [raw]
Subject: Re: [PATCH] usb: phy: msm: fix a possible NULL dereference


Hi,

LABBE Corentin <[email protected]> writes:
> of_match_device could return NULL, and so cause a NULL pointer
> dereference later. Renaming id to of_id (like all others do) in the
> process.
>
> Reported-by: coverity (CID 1324133)
> Signed-off-by: LABBE Corentin <[email protected]>
> ---
> drivers/usb/phy/phy-msm-usb.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
> index 80eb991..c4a66cf 100644
> --- a/drivers/usb/phy/phy-msm-usb.c
> +++ b/drivers/usb/phy/phy-msm-usb.c
> @@ -1506,20 +1506,23 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
> {
> struct msm_otg_platform_data *pdata;
> struct extcon_dev *ext_id, *ext_vbus;
> - const struct of_device_id *id;
> + const struct of_device_id *of_id;

and why did you need to rename this variable ? Please resend without the
variable rename.

--
balbi


Attachments:
signature.asc (818.00 B)

2015-11-16 19:18:45

by Corentin Labbe

[permalink] [raw]
Subject: Re: [PATCH] usb: phy: msm: fix a possible NULL dereference

Le 16/11/2015 18:07, Felipe Balbi a ?crit :
>
> Hi,
>
> LABBE Corentin <[email protected]> writes:
>> of_match_device could return NULL, and so cause a NULL pointer
>> dereference later. Renaming id to of_id (like all others do) in the
>> process.
>>
>> Reported-by: coverity (CID 1324133)
>> Signed-off-by: LABBE Corentin <[email protected]>
>> ---
>> drivers/usb/phy/phy-msm-usb.c | 9 ++++++---
>> 1 file changed, 6 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
>> index 80eb991..c4a66cf 100644
>> --- a/drivers/usb/phy/phy-msm-usb.c
>> +++ b/drivers/usb/phy/phy-msm-usb.c
>> @@ -1506,20 +1506,23 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
>> {
>> struct msm_otg_platform_data *pdata;
>> struct extcon_dev *ext_id, *ext_vbus;
>> - const struct of_device_id *id;
>> + const struct of_device_id *of_id;
>
> and why did you need to rename this variable ? Please resend without the
> variable rename.
>

I was renaming because all other drivers call it of_id, but I got hint from another thread to use of_device_get_match_data() which will permit to remove that variable, and still solve the issue.

Regards

2015-11-16 19:23:09

by Felipe Balbi

[permalink] [raw]
Subject: Re: [PATCH] usb: phy: msm: fix a possible NULL dereference


Hi,

(you need to break your lines at 80 characters)

Corentin LABBE <[email protected]> writes:
> Le 16/11/2015 18:07, Felipe Balbi a écrit :
>>
>> Hi,
>>
>> LABBE Corentin <[email protected]> writes:
>>> of_match_device could return NULL, and so cause a NULL pointer
>>> dereference later. Renaming id to of_id (like all others do) in the
>>> process.
>>>
>>> Reported-by: coverity (CID 1324133)
>>> Signed-off-by: LABBE Corentin <[email protected]>
>>> ---
>>> drivers/usb/phy/phy-msm-usb.c | 9 ++++++---
>>> 1 file changed, 6 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/usb/phy/phy-msm-usb.c b/drivers/usb/phy/phy-msm-usb.c
>>> index 80eb991..c4a66cf 100644
>>> --- a/drivers/usb/phy/phy-msm-usb.c
>>> +++ b/drivers/usb/phy/phy-msm-usb.c
>>> @@ -1506,20 +1506,23 @@ static int msm_otg_read_dt(struct platform_device *pdev, struct msm_otg *motg)
>>> {
>>> struct msm_otg_platform_data *pdata;
>>> struct extcon_dev *ext_id, *ext_vbus;
>>> - const struct of_device_id *id;
>>> + const struct of_device_id *of_id;
>>
>> and why did you need to rename this variable ? Please resend without the
>> variable rename.
>>
>
> I was renaming because all other drivers call it of_id, but I got hint
> from another thread to use of_device_get_match_data() which will
> permit to remove that variable, and still solve the issue.

for -rc we usually want the smallest patch needed to fix the issue. That
would be the two line if() condition. If converting to
of_device_get_match_data() is about the same (2 or 3 lines), then it
should be fine; but as a general rule of thumb: we don't fix and
cleanup/refactor on the same patch unless strictly necessary.

--
balbi


Attachments:
signature.asc (818.00 B)