Message ID | 1420597628-317-1-git-send-email-andy.shevchenko@gmail.com (mailing list archive) |
---|---|
State | Rejected, archived |
Delegated to: | Guennadi Liakhovetski |
Headers |
Received: from mail.tu-berlin.de ([130.149.7.33]) by www.linuxtv.org with esmtp (Exim 4.72) (envelope-from <linux-media-owner@vger.kernel.org>) id 1Y8gLP-0004AX-4o; Wed, 07 Jan 2015 03:27:35 +0100 X-tubIT-Incoming-IP: 209.132.180.67 Received: from vger.kernel.org ([209.132.180.67]) by mail.tu-berlin.de (exim-4.72/mailfrontend-8) with esmtp id 1Y8gLM-0007Zw-m9; Wed, 07 Jan 2015 03:27:34 +0100 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754917AbbAGC1Y (ORCPT <rfc822;mkrufky@linuxtv.org> + 1 other); Tue, 6 Jan 2015 21:27:24 -0500 Received: from gw01.mail.saunalahti.fi ([195.197.172.115]:55094 "EHLO gw01.mail.saunalahti.fi" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754845AbbAGC1W (ORCPT <rfc822; linux-media@vger.kernel.org>); Tue, 6 Jan 2015 21:27:22 -0500 Received: from localhost.localdomain (a91-152-110-231.elisa-laajakaista.fi [91.152.110.231]) by gw01.mail.saunalahti.fi (Postfix) with ESMTP id 12E604000B; Wed, 7 Jan 2015 04:27:14 +0200 (EET) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by localhost.localdomain (8.14.7/8.14.7) with ESMTP id t072RCxP000361; Wed, 7 Jan 2015 04:27:12 +0200 Received: (from andy@localhost) by localhost.localdomain (8.14.7/8.14.7/Submit) id t072R9R3000359; Wed, 7 Jan 2015 04:27:09 +0200 X-Authentication-Warning: localhost.localdomain: andy set sender to andy.shevchenko@gmail.com using -f From: Andy Shevchenko <andy.shevchenko@gmail.com> To: Guennadi Liakhovetski <g.liakhovetski@gmx.de>, Mauro Carvalho Chehab <mchehab@osg.samsung.com>, linux-media@vger.kernel.org Cc: Andy Shevchenko <andy.shevchenko@gmail.com> Subject: [PATCH] [media] soc_camera: avoid potential null-dereference Date: Wed, 7 Jan 2015 04:27:08 +0200 Message-Id: <1420597628-317-1-git-send-email-andy.shevchenko@gmail.com> X-Mailer: git-send-email 1.8.3.101.g727a46b Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: <linux-media.vger.kernel.org> X-Mailing-List: linux-media@vger.kernel.org X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2015.1.7.21818 X-PMX-Spam: Gauge=IIIIIIII, Probability=8%, Report=' FORGED_FROM_GMAIL 0.1, HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_1300_1399 0, BODY_SIZE_2000_LESS 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, URI_ENDS_IN_HTML 0, __ANY_URI 0, __CP_URI_IN_BODY 0, __FRAUD_BODY_WEBMAIL 0, __FRAUD_WEBMAIL 0, __FRAUD_WEBMAIL_FROM 0, __FROM_GMAIL 0, __HAS_FROM 0, __HAS_MSGID 0, __HAS_X_MAILER 0, __HAS_X_MAILING_LIST 0, __MIME_TEXT_ONLY 0, __PHISH_SPEAR_STRUCTURE_1 0, __SANE_MSGID 0, __TO_MALFORMED_2 0, __URI_NO_WWW 0, __URI_NS ' |
Commit Message
Andy Shevchenko
Jan. 7, 2015, 2:27 a.m. UTC
We have to check the pointer before dereferencing it.
Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
---
drivers/media/platform/soc_camera/soc_camera.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Comments
Hi Andy, Thanks for the patch. Will queue for the next pull request. Regards Guennadi On Wed, 7 Jan 2015, Andy Shevchenko wrote: > We have to check the pointer before dereferencing it. > > Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> > --- > drivers/media/platform/soc_camera/soc_camera.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c > index b3db51c..8c665c4 100644 > --- a/drivers/media/platform/soc_camera/soc_camera.c > +++ b/drivers/media/platform/soc_camera/soc_camera.c > @@ -2166,7 +2166,7 @@ static int soc_camera_video_start(struct soc_camera_device *icd) > static int soc_camera_pdrv_probe(struct platform_device *pdev) > { > struct soc_camera_desc *sdesc = pdev->dev.platform_data; > - struct soc_camera_subdev_desc *ssdd = &sdesc->subdev_desc; > + struct soc_camera_subdev_desc *ssdd; > struct soc_camera_device *icd; > int ret; > > @@ -2177,6 +2177,8 @@ static int soc_camera_pdrv_probe(struct platform_device *pdev) > if (!icd) > return -ENOMEM; > > + ssdd = &sdesc->subdev_desc; > + > /* > * In the asynchronous case ssdd->num_regulators == 0 yet, so, the below > * regulator allocation is a dummy. They are actually requested by the > -- > 1.8.3.101.g727a46b > -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Jan 7, 2015 at 9:44 PM, Guennadi Liakhovetski <g.liakhovetski@gmx.de> wrote: > Hi Andy, > > Thanks for the patch. Will queue for the next pull request. If you didn't do that please wait. It seems it has one more place with similar issue. Moreover, I would like to add a person's name who reported this. > > Regards > Guennadi > > On Wed, 7 Jan 2015, Andy Shevchenko wrote: > >> We have to check the pointer before dereferencing it. >> >> Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> >> --- >> drivers/media/platform/soc_camera/soc_camera.c | 4 +++- >> 1 file changed, 3 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c >> index b3db51c..8c665c4 100644 >> --- a/drivers/media/platform/soc_camera/soc_camera.c >> +++ b/drivers/media/platform/soc_camera/soc_camera.c >> @@ -2166,7 +2166,7 @@ static int soc_camera_video_start(struct soc_camera_device *icd) >> static int soc_camera_pdrv_probe(struct platform_device *pdev) >> { >> struct soc_camera_desc *sdesc = pdev->dev.platform_data; >> - struct soc_camera_subdev_desc *ssdd = &sdesc->subdev_desc; >> + struct soc_camera_subdev_desc *ssdd; >> struct soc_camera_device *icd; >> int ret; >> >> @@ -2177,6 +2177,8 @@ static int soc_camera_pdrv_probe(struct platform_device *pdev) >> if (!icd) >> return -ENOMEM; >> >> + ssdd = &sdesc->subdev_desc; >> + >> /* >> * In the asynchronous case ssdd->num_regulators == 0 yet, so, the below >> * regulator allocation is a dummy. They are actually requested by the >> -- >> 1.8.3.101.g727a46b >>
On Wed, Jan 7, 2015 at 10:05 PM, Andy Shevchenko <andy.shevchenko@gmail.com> wrote: > On Wed, Jan 7, 2015 at 9:44 PM, Guennadi Liakhovetski > <g.liakhovetski@gmx.de> wrote: >> Hi Andy, >> >> Thanks for the patch. Will queue for the next pull request. > > If you didn't do that please wait. It seems it has one more place with > similar issue. Moreover, I would like to add a person's name who > reported this. Okay, the second one is false positive. And Reported-by: Andrey Karpov <karpov@viva64.com> > >> >> Regards >> Guennadi >> >> On Wed, 7 Jan 2015, Andy Shevchenko wrote: >> >>> We have to check the pointer before dereferencing it. >>> >>> Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> >>> --- >>> drivers/media/platform/soc_camera/soc_camera.c | 4 +++- >>> 1 file changed, 3 insertions(+), 1 deletion(-) >>> >>> diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c >>> index b3db51c..8c665c4 100644 >>> --- a/drivers/media/platform/soc_camera/soc_camera.c >>> +++ b/drivers/media/platform/soc_camera/soc_camera.c >>> @@ -2166,7 +2166,7 @@ static int soc_camera_video_start(struct soc_camera_device *icd) >>> static int soc_camera_pdrv_probe(struct platform_device *pdev) >>> { >>> struct soc_camera_desc *sdesc = pdev->dev.platform_data; >>> - struct soc_camera_subdev_desc *ssdd = &sdesc->subdev_desc; >>> + struct soc_camera_subdev_desc *ssdd; >>> struct soc_camera_device *icd; >>> int ret; >>> >>> @@ -2177,6 +2177,8 @@ static int soc_camera_pdrv_probe(struct platform_device *pdev) >>> if (!icd) >>> return -ENOMEM; >>> >>> + ssdd = &sdesc->subdev_desc; >>> + >>> /* >>> * In the asynchronous case ssdd->num_regulators == 0 yet, so, the below >>> * regulator allocation is a dummy. They are actually requested by the >>> -- >>> 1.8.3.101.g727a46b >>> > > > > -- > With Best Regards, > Andy Shevchenko
On Wed, 7 Jan 2015, Guennadi Liakhovetski wrote: > Hi Andy, > > Thanks for the patch. Will queue for the next pull request. Actually no, I won't. I don't think there's currently a but there. the pointer isn't dereferenced before being checked. Only an address of a field in a struct, it's pointing to is calculated. So, if it's NULL just a small offset will be calculated, but no dereferencing will take place. Thanks Guennadi > Regards > Guennadi > > On Wed, 7 Jan 2015, Andy Shevchenko wrote: > > > We have to check the pointer before dereferencing it. > > > > Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com> > > --- > > drivers/media/platform/soc_camera/soc_camera.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c > > index b3db51c..8c665c4 100644 > > --- a/drivers/media/platform/soc_camera/soc_camera.c > > +++ b/drivers/media/platform/soc_camera/soc_camera.c > > @@ -2166,7 +2166,7 @@ static int soc_camera_video_start(struct soc_camera_device *icd) > > static int soc_camera_pdrv_probe(struct platform_device *pdev) > > { > > struct soc_camera_desc *sdesc = pdev->dev.platform_data; > > - struct soc_camera_subdev_desc *ssdd = &sdesc->subdev_desc; > > + struct soc_camera_subdev_desc *ssdd; > > struct soc_camera_device *icd; > > int ret; > > > > @@ -2177,6 +2177,8 @@ static int soc_camera_pdrv_probe(struct platform_device *pdev) > > if (!icd) > > return -ENOMEM; > > > > + ssdd = &sdesc->subdev_desc; > > + > > /* > > * In the asynchronous case ssdd->num_regulators == 0 yet, so, the below > > * regulator allocation is a dummy. They are actually requested by the > > -- > > 1.8.3.101.g727a46b > > > -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/media/platform/soc_camera/soc_camera.c b/drivers/media/platform/soc_camera/soc_camera.c index b3db51c..8c665c4 100644 --- a/drivers/media/platform/soc_camera/soc_camera.c +++ b/drivers/media/platform/soc_camera/soc_camera.c @@ -2166,7 +2166,7 @@ static int soc_camera_video_start(struct soc_camera_device *icd) static int soc_camera_pdrv_probe(struct platform_device *pdev) { struct soc_camera_desc *sdesc = pdev->dev.platform_data; - struct soc_camera_subdev_desc *ssdd = &sdesc->subdev_desc; + struct soc_camera_subdev_desc *ssdd; struct soc_camera_device *icd; int ret; @@ -2177,6 +2177,8 @@ static int soc_camera_pdrv_probe(struct platform_device *pdev) if (!icd) return -ENOMEM; + ssdd = &sdesc->subdev_desc; + /* * In the asynchronous case ssdd->num_regulators == 0 yet, so, the below * regulator allocation is a dummy. They are actually requested by the