video/saa7134: potential null dereferences in debug code

  I modified the dprintk and i2cdprintk macros to handle null dev and ir
pointers.  There are two couple places that call dprintk() when "dev" is
null.  One is in get_key_msi_tvanywhere_plus() and the other is in
get_key_flydvb_trio(). 

Signed-off-by: Dan Carpenter <error27@gmail.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
  

Hi Dan,

On Sat, 22 May 2010 22:15:35 +0200, Dan Carpenter wrote:
> I modified the dprintk and i2cdprintk macros to handle null dev and ir
> pointers.  There are two couple places that call dprintk() when "dev" is
> null.  One is in get_key_msi_tvanywhere_plus() and the other is in
> get_key_flydvb_trio(). 
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> 
> diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
> index e5565e2..e14f2f8 100644
> --- a/drivers/media/video/saa7134/saa7134-input.c
> +++ b/drivers/media/video/saa7134/saa7134-input.c
> @@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
>      "alternative remotes from other manufacturers");
>  
>  #define dprintk(fmt, arg...)	if (ir_debug) \
> -	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
> +	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
>  #define i2cdprintk(fmt, arg...)    if (ir_debug) \
> -	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
> +	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
>  
>  /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
>  static int saa7134_rc5_irq(struct saa7134_dev *dev);

I would have used "(null)" instead of "<null>" for consistency with
lib/vsprintf.c:string().

But more importantly, I suspect that a better fix would be to not call
these macros when dev or ir, respectively, is NULL. The faulty dprintk
calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could
be replaced with i2cdprintk (which is misnamed IMHO, BTW.)
  

Em Sat, 22 May 2010 22:59:21 +0200
Jean Delvare <khali@linux-fr.org> escreveu:

> Hi Dan,
> 
> On Sat, 22 May 2010 22:15:35 +0200, Dan Carpenter wrote:
> > I modified the dprintk and i2cdprintk macros to handle null dev and ir
> > pointers.  There are two couple places that call dprintk() when "dev" is
> > null.  One is in get_key_msi_tvanywhere_plus() and the other is in
> > get_key_flydvb_trio(). 
> > 
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
> > 
> > diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
> > index e5565e2..e14f2f8 100644
> > --- a/drivers/media/video/saa7134/saa7134-input.c
> > +++ b/drivers/media/video/saa7134/saa7134-input.c
> > @@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
> >      "alternative remotes from other manufacturers");
> >  
> >  #define dprintk(fmt, arg...)	if (ir_debug) \
> > -	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
> > +	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
> >  #define i2cdprintk(fmt, arg...)    if (ir_debug) \
> > -	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
> > +	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
> >  
> >  /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
> >  static int saa7134_rc5_irq(struct saa7134_dev *dev);
> 
> I would have used "(null)" instead of "<null>" for consistency with
> lib/vsprintf.c:string().
> 
> But more importantly, I suspect that a better fix would be to not call
> these macros when dev or ir, respectively, is NULL. The faulty dprintk
> calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could
> be replaced with i2cdprintk (which is misnamed IMHO, BTW.)

Agreed.

Dan, could you please rework your patch according with Jean's feedback?

Thanks,
Mauro
  

On Sat, 29 May 2010 01:29:54 -0300, Mauro Carvalho Chehab wrote:
> Em Sat, 22 May 2010 22:59:21 +0200
> Jean Delvare <khali@linux-fr.org> escreveu:
> > I would have used "(null)" instead of "<null>" for consistency with
> > lib/vsprintf.c:string().
> > 
> > But more importantly, I suspect that a better fix would be to not call
> > these macros when dev or ir, respectively, is NULL. The faulty dprintk
> > calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could
> > be replaced with i2cdprintk (which is misnamed IMHO, BTW.)
> 
> Agreed.
> 
> Dan, could you please rework your patch according with Jean's feedback?

He did already.