Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 9 Mar 2019 16:19:17 +0100
From:   Tomasz Duszynski <tduszyns@gmail.com>
To:     Kangjie Lu <kjlu@umn.edu>
Cc:     pakki001@umn.edu, Jonathan Cameron <jic23@kernel.org>,
        Hartmut Knaack <knaack.h@gmx.de>,
        Lars-Peter Clausen <lars@metafoo.de>,
        Peter Meerwald-Stadler <pmeerw@pmeerw.net>,
        Stefan Agner <stefan@agner.ch>,
        Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>,
        linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] iio: max9611: fix a NULL pointer dereference
Message-ID: <20190309151916.GB7820@arch>
References: <20190309045141.8015-1-kjlu@umn.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <20190309045141.8015-1-kjlu@umn.edu>
User-Agent: Mutt/1.11.3 (2019-02-01)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Mar 08, 2019 at 10:51:40PM -0600, Kangjie Lu wrote:
> of_match_device may return NULL when it fails, and in this case,
> there will be a NULL pointer dereference. The fix returns
> EINVAL when of_match_device returns NULL.
>
> Signed-off-by: Kangjie Lu <kjlu@umn.edu>
> ---
>  drivers/iio/adc/max9611.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
> index 917223d5ff5b..531b6614ea29 100644
> --- a/drivers/iio/adc/max9611.c
> +++ b/drivers/iio/adc/max9611.c
> @@ -524,13 +524,16 @@ static int max9611_probe(struct i2c_client *client,
>  {
>  	const char * const shunt_res_prop = "shunt-resistor-micro-ohms";
>  	const struct device_node *of_node = client->dev.of_node;
> -	const struct of_device_id *of_id =
> -		of_match_device(max9611_of_table, &client->dev);

Given we got to this point how this can go wrong?

> +	const struct of_device_id *of_id;
>  	struct max9611_dev *max9611;
>  	struct iio_dev *indio_dev;
>  	unsigned int of_shunt;
>  	int ret;
>
> +	of_id = of_match_device(max9611_of_table, &client->dev);
> +	if (!of_id)
> +		return -EINVAL;
> +
>  	indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*max9611));
>  	if (!indio_dev)
>  		return -ENOMEM;
> --
> 2.17.1
>