video/saa7134: potential null dereferences in debug code

PATCH In review Dan Carpenter 3 participants 6 messages May 22, 2010 – May 29, 2010

Subsystems (2)

Media (V4L/DVB) Kernel janitors

lore

Share & tools

lore

Dan Carpenter

author

2010-05-22 20:15 UTC #0 lore raw

PATCH 1/1 video/saa7134: potential null dereferences in debug code

I modified the dprintk and i2cdprintk macros to handle null dev and ir pointers. There are two couple places that call dprintk() when "dev" is null. One is in get_key_msi_tvanywhere_plus() and the other is in get_key_flydvb_trio().

Signed-off-by Dan Carpenter <[email protected]>

drivers/media/video/saa7134/saa7134-input.c +2 -2

index e5565e2..e14f2f8 100644
@@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
     "alternative remotes from other manufacturers");
 
 #define dprintk(fmt, arg...)	if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
 #define i2cdprintk(fmt, arg...)    if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
 
 /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
 static int saa7134_rc5_irq(struct saa7134_dev *dev);

Jean Delvare

2010-05-22 20:59 UTC #1 lore raw

Re: [patch] video/saa7134: potential null dereferences in debug

Hi Dan,

Quoted 13 lines · Dan Carpenter

I modified the dprintk and i2cdprintk macros to handle null dev and ir pointers. There are two couple places that call dprintk() when "dev" is null. One is in get_key_msi_tvanywhere_plus() and the other is in get_key_flydvb_trio().
Signed-off-by Dan Carpenter <[email protected]>
drivers/media/video/saa7134/saa7134-input.c +0 -0
index e5565e2..e14f2f8 100644
@@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
     "alternative remotes from other manufacturers");

drivers/media/video/saa7134/saa7134-input.c MODULE_PARM_DESC(disable_other_ir, "disable full codes of " · line 69

Quoted 10 lines

drivers/media/video/saa7134/saa7134-input.c +2 -2

 
 #define dprintk(fmt, arg...)	if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
 #define i2cdprintk(fmt, arg...)    if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
 
 /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
 static int saa7134_rc5_irq(struct saa7134_dev *dev);

I would have used "(null)" instead of "<null>" for consistency with lib/vsprintf.c:string().

But more importantly, I suspect that a better fix would be to not call these macros when dev or ir, respectively, is NULL. The faulty dprintk calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could be replaced with i2cdprintk (which is misnamed IMHO, BTW.)

Signature · 1 line

Jean Delvare

Dan Carpenter

author

2010-05-24 15:59 UTC #2 lore raw

PATCH v2 1/1 video/saa7134: change dprintk() to i2cdprintk()

The problem is that dprintk() dereferences "dev" which is null here. The i2cdprintk() uses "ir" so that's OK.

Also removed a duplicated break statement.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: Jean Delvare suggested that I use i2cdprintk() instead of modifying dprintk().

drivers/media/video/saa7134/saa7134-input.c +4 -5

index e5565e2..7691bf2 100644
@@ -141,8 +141,8 @@ static int get_key_flydvb_trio(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 	struct saa7134_dev *dev = ir->c->adapter->algo_data;
 
 	if (dev = NULL) {
-		dprintk("get_key_flydvb_trio: "
-			 "gir->c->adapter->algo_data is NULL!\n");
+		i2cdprintk("get_key_flydvb_trio: "
+			   "gir->c->adapter->algo_data is NULL!\n");
 		return -EIO;
 	}

@@ -195,8 +195,8 @@ static int get_key_msi_tvanywhere_plus(struct IR_i2c *ir, u32 *ir_key,
 	/* <dev> is needed to access GPIO. Used by the saa_readl macro. */
 	struct saa7134_dev *dev = ir->c->adapter->algo_data;
 	if (dev = NULL) {
-		dprintk("get_key_msi_tvanywhere_plus: "
-			"gir->c->adapter->algo_data is NULL!\n");
+		i2cdprintk("get_key_msi_tvanywhere_plus: "
+			   "gir->c->adapter->algo_data is NULL!\n");
 		return -EIO;
 	}

@@ -815,7 +815,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
 		mask_keyup   = 0x020000;
 		polling      = 50; /* ms */
 		break;
-	break;
 	}
 	if (NULL = ir_codes) {
 		printk("%s: Oops: IR config error [card=%d]\n",

Jean Delvare

Acked-by on v2 1/1

2010-05-24 18:04 UTC #3 lore raw

Re: [patch v2] video/saa7134: change dprintk() to i2cdprintk()

Hi Dan,

Quoted 4 lines · Dan Carpenter

The problem is that dprintk() dereferences "dev" which is null here. The i2cdprintk() uses "ir" so that's OK.
Also removed a duplicated break statement.

Mixing two unrelated fixes in the same patch is a bad idea. Here, the replacement of dprintk() with i2cdprintk() fixes a potential NULL pointer dereference, this might be worth backporting to stable kernel series. The double break, OTOH, can't cause any harm, it's a simple clean-up. So separate patches would be preferable.

Quoted 33 lines

Signed-off-by Dan Carpenter <[email protected]>

---
v2: Jean Delvare suggested that I use i2cdprintk() instead of modifying dprintk().

drivers/media/video/saa7134/saa7134-input.c +4 -4

index e5565e2..7691bf2 100644
@@ -141,8 +141,8 @@ static int get_key_flydvb_trio(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 	struct saa7134_dev *dev = ir->c->adapter->algo_data;
 
 	if (dev = NULL) {
-		dprintk("get_key_flydvb_trio: "
-			 "gir->c->adapter->algo_data is NULL!\n");
+		i2cdprintk("get_key_flydvb_trio: "
+			   "gir->c->adapter->algo_data is NULL!\n");
 		return -EIO;
 	}

@@ -195,8 +195,8 @@ static int get_key_msi_tvanywhere_plus(struct IR_i2c *ir, u32 *ir_key,
 	/* <dev> is needed to access GPIO. Used by the saa_readl macro. */
 	struct saa7134_dev *dev = ir->c->adapter->algo_data;
 	if (dev = NULL) {
-		dprintk("get_key_msi_tvanywhere_plus: "
-			"gir->c->adapter->algo_data is NULL!\n");
+		i2cdprintk("get_key_msi_tvanywhere_plus: "
+			   "gir->c->adapter->algo_data is NULL!\n");
 		return -EIO;
 	}

drivers/media/video/saa7134/saa7134-input.c int saa7134_input_init1(struct saa7134_dev *dev) · line 820

Quoted 7 lines

drivers/media/video/saa7134/saa7134-input.c +0 -1

@@ -815,7 +815,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
 		mask_keyup   = 0x020000;
 		polling      = 50; /* ms */
 		break;
-	break;
 	}
 	if (NULL = ir_codes) {
 		printk("%s: Oops: IR config error [card=%d]\n",

Acked-by Jean Delvare <[email protected]>

Signature · 1 line

Jean Delvare

Mauro Carvalho Chehab

2010-05-29 04:29 UTC #4 lore raw

Re: [patch] video/saa7134: potential null dereferences in debug

In reply to Jean Delvare

Em Sat, 22 May 2010 22:59:21 +0200
Jean Delvare <[email protected]> escreveu:

Quoted 30 lines

Hi Dan,
Quoted 13 lines · Dan Carpenter
I modified the dprintk and i2cdprintk macros to handle null dev and ir pointers. There are two couple places that call dprintk() when "dev" is null. One is in get_key_msi_tvanywhere_plus() and the other is in get_key_flydvb_trio().
Signed-off-by Dan Carpenter <[email protected]>
drivers/media/video/saa7134/saa7134-input.c +0 -0
index e5565e2..e14f2f8 100644
@@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
     "alternative remotes from other manufacturers");
drivers/media/video/saa7134/saa7134-input.c MODULE_PARM_DESC(disable_other_ir, "disable full codes of " · line 69
Quoted 10 lines
drivers/media/video/saa7134/saa7134-input.c +2 -2
 
 #define dprintk(fmt, arg...)	if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
 #define i2cdprintk(fmt, arg...)    if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
 
 /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
 static int saa7134_rc5_irq(struct saa7134_dev *dev);
I would have used "(null)" instead of "<null>" for consistency with lib/vsprintf.c:string().

Quoted 4 lines

But more importantly, I suspect that a better fix would be to not call these macros when dev or ir, respectively, is NULL. The faulty dprintk calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could be replaced with i2cdprintk (which is misnamed IMHO, BTW.)

Agreed.

Dan, could you please rework your patch according with Jean's feedback?

Thanks,
Mauro

Signature · 2 lines

Cheers,
Mauro

Jean Delvare

2010-05-29 07:06 UTC #5 lore raw

Re: [patch] video/saa7134: potential null dereferences in debug

Quoted 5 lines · Mauro Carvalho Chehab

Em Sat, 22 May 2010 22:59:21 +0200
Jean Delvare <[email protected]> escreveu:
Quoted 3 lines
I would have used "(null)" instead of "<null>" for consistency with lib/vsprintf.c:string().

Quoted 8 lines

Quoted 4 lines
But more importantly, I suspect that a better fix would be to not call these macros when dev or ir, respectively, is NULL. The faulty dprintk calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could be replaced with i2cdprintk (which is misnamed IMHO, BTW.)
Agreed.
Dan, could you please rework your patch according with Jean's feedback?

He did already.

Signature · 1 line

Jean Delvare