Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH 1/3] mmc: sdhci-s3c: fix possible NULL pointer dereference
 when probed via platform
To:     Sylwester Nawrocki <snawrocki@kernel.org>,
        Ben Dooks <ben-linux@fluff.org>,
        Jaehoon Chung <jh80.chung@samsung.com>,
        Adrian Hunter <adrian.hunter@intel.com>,
        Ulf Hansson <ulf.hansson@linaro.org>,
        linux-mmc@vger.kernel.org, linux-kernel@vger.kernel.org
Cc:     Marek Szyprowski <m.szyprowski@samsung.com>
References: <20210414151242.102313-1-krzysztof.kozlowski@canonical.com>
 <a0ac5d21-acc1-825a-1585-f8d897902b14@canonical.com>
 <74059494-3610-c24e-7d09-b89106c0a396@kernel.org>
From:   Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Message-ID: <f66d3d81-d824-18e9-18e2-098b1f85f664@canonical.com>
Date:   Thu, 15 Apr 2021 10:41:44 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.7.1
MIME-Version: 1.0
In-Reply-To: <74059494-3610-c24e-7d09-b89106c0a396@kernel.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 14/04/2021 18:49, Sylwester Nawrocki wrote:
> On 14.04.2021 17:25, Krzysztof Kozlowski wrote:
>> On 14/04/2021 17:12, Krzysztof Kozlowski wrote:
>>> The driver can be matched by legacy platform way or OF-device matching.
>>> In the first case, of_match_node() can return NULL, which immediately
>>> would be dereferenced to get the match data.
>>>
>>> Addresses-Coverity: Dereference null return value
>>> Fixes: cd1b00eb24b0 ("mmc: sdhci-s3c: Add device tree support")
>>> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
> 
>>> -#ifdef CONFIG_OF
>>> -static const struct of_device_id sdhci_s3c_dt_match[];
>>> -#endif
>>> -
>>>   static inline struct sdhci_s3c_drv_data *sdhci_s3c_get_driver_data(
>>>   			struct platform_device *pdev)
>>>   {
>>>   #ifdef CONFIG_OF
>>> -	if (pdev->dev.of_node) {
>>> -		const struct of_device_id *match;
>>> -		match = of_match_node(sdhci_s3c_dt_match, pdev->dev.of_node);
>>
>> Now I have second thoughts whether NULL pointer can actually happen.  If
>> device is matched via platform/board files, maybe the pdev->dev.of_node
>> will be NULL thus skipping this branch?
>>
>> Could there be a case where device is matched via platform_device_id()
>> (which has different name than compatible!) and (pdev->dev.of_node) is
>> still assigned? Maybe in case of out of tree DTS?
> 
> That seems unlikely, the platform device would need to be initialized
> via board file and then its of_node assigned somehow. It doesn't make
> much sense to me. We either use board file or dtb to instantiate devices.
> 
>> Anyway, the patch makes the code simpler/smaller, so I still think it is
>> reasonable. Just the severity of issue is questionable...
> 
> Yes, the patch looks good. Similar cleanups are already done in most of
> the s3c/s5p/exynos drivers.

Thanks Sylwester, I'll resend with different description.


Best regards,
Krzysztof