Skip to contentSkip to conversation

regulator/wm831x-dcdc: fix potential NULL dereference

PATCH In review Axel Lin 2 participants 6 messages Aug 20, 2010

Subsystems (2)
Voltage and current regulator framework Wolfson microelectronics drivers
lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH 1/4 regulator/wm831x-dcdc: fix potential NULL dereference

pdata is dereferenced earlier than tested for being NULL. Thus move the dereference of "pdata" below the check for NULL.

Signed-off-by Axel Lin <[email protected]>
---
 drivers/regulator/wm831x-dcdc.c |   36 ++++++++++++++++++++++++------------
 1 files changed, 24 insertions(+), 12 deletions(-)
drivers/regulator/wm831x-dcdc.c +24 -12
index dbfaf59..ed66fac 100644
@@ -501,14 +501,17 @@ static __devinit int wm831x_buckv_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->dcdc);
 	struct wm831x_dcdc *dcdc;
 	struct resource *res;
-	int ret, irq;
+	int id, ret, irq;
 
+	if (pdata == NULL)
+		return -ENODEV;
+
+	id = pdev->id % ARRAY_SIZE(pdata->dcdc);
 	dev_dbg(&pdev->dev, "Probing DCDC%d\n", id + 1);
 
-	if (pdata == NULL || pdata->dcdc[id] == NULL)
+	if (pdata->dcdc[id] == NULL)
 		return -ENODEV;
 
 	dcdc = kzalloc(sizeof(struct wm831x_dcdc), GFP_KERNEL);

@@ -704,14 +707,17 @@ static __devinit int wm831x_buckp_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->dcdc);
 	struct wm831x_dcdc *dcdc;
 	struct resource *res;
-	int ret, irq;
+	int id, ret, irq;
 
+	if (pdata == NULL)
+		return -ENODEV;
+
+	id = pdev->id % ARRAY_SIZE(pdata->dcdc);
 	dev_dbg(&pdev->dev, "Probing DCDC%d\n", id + 1);
 
-	if (pdata == NULL || pdata->dcdc[id] == NULL)
+	if (pdata->dcdc[id] == NULL)
 		return -ENODEV;
 
 	dcdc = kzalloc(sizeof(struct wm831x_dcdc), GFP_KERNEL);

@@ -834,14 +840,17 @@ static __devinit int wm831x_boostp_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->dcdc);
 	struct wm831x_dcdc *dcdc;
 	struct resource *res;
-	int ret, irq;
+	int id, ret, irq;
 
+	if (pdata == NULL)
+		return -ENODEV;
+
+	id = pdev->id % ARRAY_SIZE(pdata->dcdc);
 	dev_dbg(&pdev->dev, "Probing DCDC%d\n", id + 1);
 
-	if (pdata == NULL || pdata->dcdc[id] == NULL)
+	if (pdata->dcdc[id] == NULL)
 		return -ENODEV;
 
 	dcdc = kzalloc(sizeof(struct wm831x_dcdc), GFP_KERNEL);

@@ -940,13 +949,16 @@ static __devinit int wm831x_epe_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->epe);
 	struct wm831x_dcdc *dcdc;
-	int ret;
+	int id, ret;
+
+	if (pdata == NULL)
+		return -ENODEV;
 
+	id = pdev->id % ARRAY_SIZE(pdata->epe);
 	dev_dbg(&pdev->dev, "Probing EPE%d\n", id + 1);
 
-	if (pdata == NULL || pdata->epe[id] == NULL)
+	if (pdata->epe[id] == NULL)
 		return -ENODEV;
 
 	dcdc = kzalloc(sizeof(struct wm831x_dcdc), GFP_KERNEL);
Signature · 1 line
1.7.2
author
#1 lore raw

PATCH 2/4 regulator/wm831x-isink: fix potential NULL dereference

pdata is dereferenced earlier than tested for being NULL. Thus move the dereference of "pdata" below the check for NULL.

Signed-off-by Axel Lin <[email protected]>
---
 drivers/regulator/wm831x-isink.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)
drivers/regulator/wm831x-isink.c +6 -3
index 6c446cd..123d722 100644
@@ -153,13 +153,16 @@ static __devinit int wm831x_isink_probe(struct platform_device *pdev)
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
 	struct wm831x_isink *isink;
-	int id = pdev->id % ARRAY_SIZE(pdata->isink);
 	struct resource *res;
-	int ret, irq;
+	int id, ret, irq;
 
+	if (pdata == NULL)
+		return -ENODEV;
+
+	id = pdev->id % ARRAY_SIZE(pdata->isink);
 	dev_dbg(&pdev->dev, "Probing ISINK%d\n", id + 1);
 
-	if (pdata == NULL || pdata->isink[id] == NULL)
+	if (pdata->isink[id] == NULL)
 		return -ENODEV;
 
 	isink = kzalloc(sizeof(struct wm831x_isink), GFP_KERNEL);
Signature · 1 line
1.7.2
author
#2 lore raw

PATCH 3/4 regulator/wm831x-ldo: fix potential NULL dereference

In reply to Axel Lin

pdata is dereferenced earlier than tested for being NULL. Thus move the dereference of "pdata" below the check for NULL.

Signed-off-by Axel Lin <[email protected]>
---
 drivers/regulator/wm831x-ldo.c |   27 ++++++++++++++++++---------
 1 files changed, 18 insertions(+), 9 deletions(-)
drivers/regulator/wm831x-ldo.c +18 -9
index e686cdb..040515d 100644
@@ -303,14 +303,17 @@ static __devinit int wm831x_gp_ldo_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->ldo);
 	struct wm831x_ldo *ldo;
 	struct resource *res;
-	int ret, irq;
+	int id, ret, irq;
 
+	if (pdata == NULL)
+		return -ENODEV;
+
+	id = pdev->id % ARRAY_SIZE(pdata->ldo);
 	dev_dbg(&pdev->dev, "Probing LDO%d\n", id + 1);
 
-	if (pdata == NULL || pdata->ldo[id] == NULL)
+	if (pdata->ldo[id] == NULL)
 		return -ENODEV;
 
 	ldo = kzalloc(sizeof(struct wm831x_ldo), GFP_KERNEL);

@@ -563,14 +566,17 @@ static __devinit int wm831x_aldo_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->ldo);
 	struct wm831x_ldo *ldo;
 	struct resource *res;
-	int ret, irq;
+	int id, ret, irq;
+
+	if (pdata == NULL)
+		return -ENODEV;
 
+	id = pdev->id % ARRAY_SIZE(pdata->ldo);
 	dev_dbg(&pdev->dev, "Probing LDO%d\n", id + 1);
 
-	if (pdata == NULL || pdata->ldo[id] == NULL)
+	if (pdata->ldo[id] == NULL)
 		return -ENODEV;
 
 	ldo = kzalloc(sizeof(struct wm831x_ldo), GFP_KERNEL);

@@ -749,14 +755,17 @@ static __devinit int wm831x_alive_ldo_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->ldo);
 	struct wm831x_ldo *ldo;
 	struct resource *res;
-	int ret;
+	int id, ret;
+
+	if (pdata == NULL)
+		return -ENODEV;
 
+	id = pdev->id % ARRAY_SIZE(pdata->ldo);
 	dev_dbg(&pdev->dev, "Probing LDO%d\n", id + 1);
 
-	if (pdata == NULL || pdata->ldo[id] == NULL)
+	if (pdata->ldo[id] == NULL)
 		return -ENODEV;
 
 	ldo = kzalloc(sizeof(struct wm831x_ldo), GFP_KERNEL);
Signature · 1 line
1.7.2
author
#3 lore raw

PATCH 4/4 regulator/wm8994-regulator: fix potential NULL dereference

In reply to Axel Lin

pdata is dereferenced earlier than tested for being NULL. Thus move the dereference of "pdata" below the check for NULL.

Signed-off-by Axel Lin <[email protected]>
---
 drivers/regulator/wm8994-regulator.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)
drivers/regulator/wm8994-regulator.c +4 -4
index 03713bc..3ecc81f 100644
@@ -202,15 +202,15 @@ static __devinit int wm8994_ldo_probe(struct platform_device *pdev)
 {
 	struct wm8994 *wm8994 = dev_get_drvdata(pdev->dev.parent);
 	struct wm8994_pdata *pdata = wm8994->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->ldo);
 	struct wm8994_ldo *ldo;
-	int ret;
-
-	dev_dbg(&pdev->dev, "Probing LDO%d\n", id + 1);
+	int id, ret;
 
 	if (!pdata)
 		return -ENODEV;
 
+	id = pdev->id % ARRAY_SIZE(pdata->ldo);
+	dev_dbg(&pdev->dev, "Probing LDO%d\n", id + 1);
+
 	ldo = kzalloc(sizeof(struct wm8994_ldo), GFP_KERNEL);
 	if (ldo == NULL) {
 		dev_err(&pdev->dev, "Unable to allocate private data\n");
Signature · 1 line
1.7.2
#4 lore raw
In reply to Axel Lin
Quoted 13 lines · Axel Lin

pdata is dereferenced earlier than tested for being NULL. Thus move the dereference of "pdata" below the check for NULL.

Signed-off-by Axel Lin <[email protected]>

---
drivers/regulator/wm831x-dcdc.c | 36 ++++++++++++++++++++++++------------

1 files changed, 24 insertions(+), 12 deletions(-)
drivers/regulator/wm831x-dcdc.c +0 -0
index dbfaf59..ed66fac 100644

drivers/regulator/wm831x-dcdc.c static __devinit int wm831x_buckv_probe(struct platform_device *pdev) · line 504

Quoted 4 lines
drivers/regulator/wm831x-dcdc.c +0 -1
@@ -501,14 +501,17 @@ static __devinit int wm831x_buckv_probe(struct platform_device *pdev)
 {
 	struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
 	struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-	int id = pdev->id % ARRAY_SIZE(pdata->dcdc);

ARRAY_SIZE() isn't actually a dereference, it's evaluated at compile time.

author
#5 lore raw

2010/8/20 Mark Brown <[email protected]>:

Quoted 10 lines · Axel Lin
Quoted 9 lines

pdata is dereferenced earlier than tested for being NULL. Thus move the dereference of "pdata" below the check for NULL.

Signed-off-by Axel Lin <[email protected]>

---
drivers/regulator/wm831x-dcdc.c |   36 ++++++++++++++++++++++++------------

1 files changed, 24 insertions(+), 12 deletions(-)
Quoted 11 lines

drivers/regulator/wm831x-dcdc.c static __devinit int wm831x_buckv_probe(struct platform_device *pdev) · line 504

Quoted 9 lines
drivers/regulator/wm831x-dcdc.c +0 -1
index dbfaf59..ed66fac 100644
@@ -501,14 +501,17 @@ static __devinit int wm831x_buckv_probe(struct platform_device *pdev)
 {
       struct wm831x *wm831x = dev_get_drvdata(pdev->dev.parent);
       struct wm831x_pdata *pdata = wm831x->dev->platform_data;
-     int id = pdev->id % ARRAY_SIZE(pdata->dcdc);

ARRAY_SIZE() isn't actually a dereference, it's evaluated at compile time.

Ah. You are right! Thanks.
Axel