From patchwork Wed Jun 15 22:29:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Janusz Krzysztofik X-Patchwork-Id: 34627 Received: from mail.tu-berlin.de ([130.149.7.33]) by www.linuxtv.org with esmtp (Exim 4.84_2) (envelope-from ) id 1bDJLr-0007LU-KU; Wed, 15 Jun 2016 22:31:59 +0000 X-tubIT-Incoming-IP: 209.132.180.67 Received: from vger.kernel.org ([209.132.180.67]) by mail.tu-berlin.de (exim-4.84_2/mailfrontend-8) with esmtp id 1bDJLp-0006ML-k6; Thu, 16 Jun 2016 00:31:59 +0200 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161025AbcFOWa4 (ORCPT + 1 other); Wed, 15 Jun 2016 18:30:56 -0400 Received: from mail-lf0-f68.google.com ([209.85.215.68]:36684 "EHLO mail-lf0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932141AbcFOWay (ORCPT ); Wed, 15 Jun 2016 18:30:54 -0400 Received: by mail-lf0-f68.google.com with SMTP id a2so4001795lfe.3; Wed, 15 Jun 2016 15:30:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nGxljNGAz8NBmkRly81y7vT54i7YZzy+fsI7o6YF72w=; b=0nSGXPZlp42AixQ+Ra3W3zWwwcTebQ9hd8bHa31h8QPmCrmPzVQ+l+hgb2fdXL1e10 3z4yY9w1MNCw4kAyG1IHnqScn0iBYqaHN+AJFXTaw9HF8ZTkzIblBRP8lRG0KzzaViKd mFnFiHBO/4ynUY3d9Vbb34W1Yy1VnPEs7RoFwUbc89X+M7ZT0CCaVZCpMOR79ATXqbW5 HpHosSjEjCaN4nlJ2N1NWSsW0fnhPEZ9cPInRGp+ikI5C1XR1SpCwZWEh/MrtyknE+Wf 73Hy2TJqvLV3SZONtUop3VYnToqeObOOn3jj7eODWOqKBeV5CqfPcrQ/gqZbVNRwmG0A Vk7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=nGxljNGAz8NBmkRly81y7vT54i7YZzy+fsI7o6YF72w=; b=NLt3lEpKfHrWTAOTQfo/7xh8LAkyvyNCx+2O51kHU1DtyrT/okpHsIHKpZUICCb7k8 M/AHzcNJpnpgwvNgGGV28d22LWhsFN2AZX1dzKic4ybMDafZID+JQ65nMRt6e6vKwpoK rIwplJxC5U0R0jw2BzR2fSKKPhtfRva361C0WyXyqw/SH2E23J8J/k84aQEHGs/kzuFE 93C7tie4NpZIJNxmWAav0f+C4tlBW/3g4e9dFXXY7dUJnx1Ylv60zra/soWqBI4OLiCx cfD8VZAh1QL9TL/0C+H25LrCrtq5yCJeJUxq2YqQmy8nLUUoLbh9bs7zvMpgxT/spSKh 16Cg== X-Gm-Message-State: ALyK8tISEyPuqvckQzeLiCZbqu1fJOEx8Srkb1ecBdosh/RjQyKiNVVB4btuozPDLL6pSA== X-Received: by 10.25.156.83 with SMTP id f80mr304517lfe.141.1466029853013; Wed, 15 Jun 2016 15:30:53 -0700 (PDT) Received: from z50.lan (93-181-165-181.internetia.net.pl. [93.181.165.181]) by smtp.gmail.com with ESMTPSA id 139sm3925258ljj.1.2016.06.15.15.30.51 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 15 Jun 2016 15:30:52 -0700 (PDT) From: Janusz Krzysztofik To: Mauro Carvalho Chehab , Guennadi Liakhovetski , Greg Kroah-Hartman Cc: Hans Verkuil , Amitoj Kaur Chawla , Arnd Bergmann , Lee Jones , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, devel@driverdev.osuosl.org, Janusz Krzysztofik Subject: [PATCH 1/3] staging: media: omap1: fix null pointer dereference in omap1_cam_probe() Date: Thu, 16 Jun 2016 00:29:48 +0200 Message-Id: <1466029790-31094-2-git-send-email-jmkrzyszt@gmail.com> X-Mailer: git-send-email 2.7.3 In-Reply-To: <1466029790-31094-1-git-send-email-jmkrzyszt@gmail.com> References: <1466029790-31094-1-git-send-email-jmkrzyszt@gmail.com> Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2016.6.15.222415 X-PMX-Spam: Gauge=IIIIIIIII, Probability=9%, Report=' FORGED_FROM_GMAIL 0.1, MULTIPLE_RCPTS 0.1, HTML_00_01 0.05, HTML_00_10 0.05, BODYTEXTP_SIZE_3000_LESS 0, BODY_SIZE_2000_2999 0, BODY_SIZE_5000_LESS 0, BODY_SIZE_7000_LESS 0, DKIM_SIGNATURE 0, IN_REP_TO 0, LEGITIMATE_NEGATE 0, MSG_THREAD 0, MULTIPLE_RCPTS_RND 0, NO_URI_HTTPS 0, REFERENCES 0, SINGLE_URI_IN_BODY 0, URI_ENDS_IN_HTML 0, __ANY_URI 0, __CP_URI_IN_BODY 0, __FRAUD_BODY_WEBMAIL 0, __FRAUD_CONTACT_NAME 0, __FRAUD_WEBMAIL 0, __FRAUD_WEBMAIL_FROM 0, __FROM_GMAIL 0, __HAS_CC_HDR 0, __HAS_FROM 0, __HAS_MSGID 0, __HAS_X_MAILER 0, __HAS_X_MAILING_LIST 0, __IN_REP_TO 0, __MIME_TEXT_ONLY 0, __MULTIPLE_RCPTS_CC_X2 0, __PHISH_SPEAR_STRUCTURE_1 0, __REFERENCES 0, __SANE_MSGID 0, __SINGLE_URI_TEXT 0, __STOCK_PHRASE_24 0, __TO_MALFORMED_2 0, __URI_IN_BODY 0, __URI_NO_WWW 0, __URI_NS , __URI_WITH_PATH 0, __YOUTUBE_RCVD 0' Commit 76e543382bd4 ("staging: media: omap1: Switch to devm_ioremap_resource") moved assignment of struct resource *res = platform_get_resource() several lines down. That resulted in the following error: [ 3.793237] Unable to handle kernel NULL pointer dereference at virtual address 00000004 [ 3.802198] pgd = c0004000 [ 3.805202] [00000004] *pgd=00000000 [ 3.809373] Internal error: Oops: c5 [#1] ARM [ 3.814070] CPU: 0 PID: 1 Comm: swapper Not tainted 4.6.0-rc1+ #70 [ 3.820570] Hardware name: Amstrad E3 (Delta) [ 3.825232] task: c1819440 ti: c181e000 task.ti: c181e000 [ 3.830973] PC is at omap1_cam_probe+0x48/0x2d4 [ 3.835873] LR is at devres_add+0x20/0x28 Move the assignment back up where it was before - it is used to build an argument for a subsequent devm_kzalloc(). Also, restore the check for null value of res - it shouldn't hurt. While being at it: - follow the recently introduced convention of direct return instead of jump to return with err value assigned, - drop no longer needed res member from the definition of struct omap1_cam_dev. Created and tested on Amstrad Delta aginst Linux-4.7-rc3 Signed-off-by: Janusz Krzysztofik --- drivers/staging/media/omap1/omap1_camera.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/staging/media/omap1/omap1_camera.c b/drivers/staging/media/omap1/omap1_camera.c index 54b8dd2..dc35d30 100644 --- a/drivers/staging/media/omap1/omap1_camera.c +++ b/drivers/staging/media/omap1/omap1_camera.c @@ -158,7 +158,6 @@ struct omap1_cam_dev { int dma_ch; struct omap1_cam_platform_data *pdata; - struct resource *res; unsigned long pflags; unsigned long camexclk; @@ -1569,11 +1568,10 @@ static int omap1_cam_probe(struct platform_device *pdev) unsigned int irq; int err = 0; + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); irq = platform_get_irq(pdev, 0); - if ((int)irq <= 0) { - err = -ENODEV; - goto exit; - } + if (!res || (int)irq <= 0) + return -ENODEV; clk = devm_clk_get(&pdev->dev, "armper_ck"); if (IS_ERR(clk)) @@ -1614,7 +1612,6 @@ static int omap1_cam_probe(struct platform_device *pdev) INIT_LIST_HEAD(&pcdev->capture); spin_lock_init(&pcdev->lock); - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); base = devm_ioremap_resource(&pdev->dev, res); if (IS_ERR(base)) return PTR_ERR(base); @@ -1663,7 +1660,6 @@ static int omap1_cam_probe(struct platform_device *pdev) exit_free_dma: omap_free_dma(pcdev->dma_ch); -exit: return err; }