2015-11-05 15:55:48

by Corentin Labbe

Subject: [PATCH] gpio: 74xx: fix a possible NULL dereference

of_match_device could return NULL, and so cause a NULL pointer
dereference later at line 132:
priv->flags = (uintptr_t) of_id->data;

Reported-by: coverity (CID 1324141)
Signed-off-by: LABBE Corentin <[email protected]>
---
drivers/gpio/gpio-74xx-mmio.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
index 6ed7c0f..4a7be0f 100644
--- a/drivers/gpio/gpio-74xx-mmio.c
+++ b/drivers/gpio/gpio-74xx-mmio.c
@@ -120,6 +120,9 @@ static int mmio_74xx_gpio_probe(struct platform_device *pdev)
void __iomem *dat;
int err;

+ if (!of_id)
+ return -ENODEV;
+
priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
if (!priv)
return -ENOMEM;
--
2.4.10

2015-11-09 00:21:46

by Alexandre Courbot

Subject: Re: [PATCH] gpio: 74xx: fix a possible NULL dereference

On Fri, Nov 6, 2015 at 12:55 AM, LABBE Corentin
<[email protected]> wrote:
> of_match_device could return NULL, and so cause a NULL pointer
> dereference later at line 132:
> priv->flags = (uintptr_t) of_id->data;
>
> Reported-by: coverity (CID 1324141)
> Signed-off-by: LABBE Corentin <[email protected]>
> ---
> drivers/gpio/gpio-74xx-mmio.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
> index 6ed7c0f..4a7be0f 100644
> --- a/drivers/gpio/gpio-74xx-mmio.c
> +++ b/drivers/gpio/gpio-74xx-mmio.c
> @@ -120,6 +120,9 @@ static int mmio_74xx_gpio_probe(struct platform_device *pdev)
> void __iomem *dat;
> int err;
>
> + if (!of_id)
> + return -ENODEV;
> +

Nit: in that case, could you also move the assignment of of_id to its
own line right above these added lines? It would keep things in the
same place and the current layout does not even save any space since
the declaration of of_id currently takes two lines because the
assignment makes it longer than 80 chars...

With this,

Reviewed-by: Alexandre Courbot <[email protected]>

2015-11-09 14:16:21

by Andy Shevchenko

Subject: Re: [PATCH] gpio: 74xx: fix a possible NULL dereference

On Mon, Nov 9, 2015 at 2:21 AM, Alexandre Courbot <[email protected]> wrote:
> On Fri, Nov 6, 2015 at 12:55 AM, LABBE Corentin
> <[email protected]> wrote:
>> of_match_device could return NULL, and so cause a NULL pointer
>> dereference later at line 132:
>> priv->flags = (uintptr_t) of_id->data;
>>
>> Reported-by: coverity (CID 1324141)
>> Signed-off-by: LABBE Corentin <[email protected]>
>> ---
>> drivers/gpio/gpio-74xx-mmio.c | 3 +++
>> 1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
>> index 6ed7c0f..4a7be0f 100644
>> --- a/drivers/gpio/gpio-74xx-mmio.c
>> +++ b/drivers/gpio/gpio-74xx-mmio.c
>> @@ -120,6 +120,9 @@ static int mmio_74xx_gpio_probe(struct platform_device *pdev)
>> void __iomem *dat;
>> int err;
>>
>> + if (!of_id)
>> + return -ENODEV;
>> +
>
> Nit: in that case, could you also move the assignment of of_id to its
> own line right above these added lines? It would keep things in the
> same place

I think it's more that just a nit. +1 to move assignment.

--
With Best Regards,
Andy Shevchenko

2015-11-10 07:16:23

by Corentin Labbe

Subject: Re: [PATCH] gpio: 74xx: fix a possible NULL dereference

On Mon, Nov 09, 2015 at 04:16:16PM +0200, Andy Shevchenko wrote:
> On Mon, Nov 9, 2015 at 2:21 AM, Alexandre Courbot <[email protected]> wrote:
> > On Fri, Nov 6, 2015 at 12:55 AM, LABBE Corentin
> > <[email protected]> wrote:
> >> of_match_device could return NULL, and so cause a NULL pointer
> >> dereference later at line 132:
> >> priv->flags = (uintptr_t) of_id->data;
> >>
> >> Reported-by: coverity (CID 1324141)
> >> Signed-off-by: LABBE Corentin <[email protected]>
> >> ---
> >> drivers/gpio/gpio-74xx-mmio.c | 3 +++
> >> 1 file changed, 3 insertions(+)
> >>
> >> diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c
> >> index 6ed7c0f..4a7be0f 100644
> >> --- a/drivers/gpio/gpio-74xx-mmio.c
> >> +++ b/drivers/gpio/gpio-74xx-mmio.c
> >> @@ -120,6 +120,9 @@ static int mmio_74xx_gpio_probe(struct platform_device *pdev)
> >> void __iomem *dat;
> >> int err;
> >>
> >> + if (!of_id)
> >> + return -ENODEV;
> >> +
> >
> > Nit: in that case, could you also move the assignment of of_id to its
> > own line right above these added lines? It would keep things in the
> > same place
>
> I think it's more that just a nit. +1 to move assignment.

Hello

I agree, I will send an updated patch soon.

Regards

LABBE Corentin