Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752891AbdLER1V (ORCPT ); Tue, 5 Dec 2017 12:27:21 -0500 Received: from gateway23.websitewelcome.com ([192.185.49.180]:20577 "EHLO gateway23.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752126AbdLER1S (ORCPT ); Tue, 5 Dec 2017 12:27:18 -0500 Subject: Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt To: Patrice CHOTARD , Mauro Carvalho Chehab Cc: "linux-arm-kernel@lists.infradead.org" , "linux-media@vger.kernel.org" , "linux-kernel@vger.kernel.org" References: <20171120140055.GA728@embeddedor.com> From: "Gustavo A. R. Silva" Message-ID: <1e1f26d4-ab0e-0c73-e1ca-89bad28cd228@embeddedor.com> Date: Tue, 5 Dec 2017 11:27:10 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.155.98.198 X-Source-L: No X-Exim-ID: 1eMGzz-002RAL-UU X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.69]) [189.155.98.198]:45442 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 5 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1739 Lines: 49 Hello, On 11/21/2017 02:22 AM, Patrice CHOTARD wrote: > Hi Gustavo > > On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote: >> _channel_ is being dereferenced before it is null checked, hence there is a >> potential null pointer dereference. Fix this by moving the pointer dereference >> after _channel_ has been null checked. >> >> This issue was detected with the help of Coccinelle. >> >> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support") >> Signed-off-by: Gustavo A. R. Silva >> --- >> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++- >> 1 file changed, 3 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c >> index 59280ac..23d0ced 100644 >> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c >> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c >> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei) >> static void channel_swdemux_tsklet(unsigned long data) >> { >> struct channel_info *channel = (struct channel_info *)data; >> - struct c8sectpfei *fei = channel->fei; >> + struct c8sectpfei *fei; >> unsigned long wp, rp; >> int pos, num_packets, n, size; >> u8 *buf; >> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data) >> if (unlikely(!channel || !channel->irec)) >> return; >> >> + fei = channel->fei; >> + >> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0)); >> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0)); >> >> > Acked-by: Patrice Chotard > > Thanks Thank you, Patrice. -- Gustavo A. R. Silva