c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt

PATCH In review Gustavo A. R. Silva 2 participants 4 messages Nov 20, 2017 – Dec 5, 2017 Media (V4L/DVB)

Share & tools

Gustavo A. R. Silva

author

2017-11-20 14:00 UTC #0 lore raw

PATCH 1/1 c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt

_channel_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer dereference after _channel_ has been null checked.

This issue was detected with the help of Coccinelle.

Fixes c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
 drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +3 -1

index 59280ac..23d0ced 100644
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
 static void channel_swdemux_tsklet(unsigned long data)
 {
 	struct channel_info *channel = (struct channel_info *)data;
-	struct c8sectpfei *fei = channel->fei;
+	struct c8sectpfei *fei;
 	unsigned long wp, rp;
 	int pos, num_packets, n, size;
 	u8 *buf;

@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
 	if (unlikely(!channel || !channel->irec))
 		return;
 
+	fei = channel->fei;
+
 	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
 	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));

Signature · 1 line

2.7.4

Patrice CHOTARD

Acked-by on v1 1/1

2017-11-21 08:22 UTC #1 lore raw

Hi Gustavo

Quoted 27 lines · Gustavo A. R. Silva

_channel_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer dereference after _channel_ has been null checked.
This issue was detected with the help of Coccinelle.
Fixes c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
  drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +1 -1
index 59280ac..23d0ced 100644
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
  static void channel_swdemux_tsklet(unsigned long data)
  {
  	struct channel_info *channel = (struct channel_info *)data;
-	struct c8sectpfei *fei = channel->fei;
+	struct c8sectpfei *fei;
  	unsigned long wp, rp;
  	int pos, num_packets, n, size;
  	u8 *buf;

drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c static void channel_swdemux_tsklet(unsigned long data) · line 98

Quoted 8 lines

drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +2 -0

@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
  	if (unlikely(!channel || !channel->irec))
  		return;
 
+	fei = channel->fei;
+
  	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
  	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));

Acked-by Patrice Chotard <[email protected]>

Thanks

Gustavo A. R. Silva

author

2017-11-22 14:21 UTC #2 lore raw

Quoted 40 lines · Patrice CHOTARD

Hi Gustavo
Quoted 27 lines · Gustavo A. R. Silva
_channel_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer dereference after _channel_ has been null checked.
This issue was detected with the help of Coccinelle.
Fixes c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
   drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
   1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +1 -1
index 59280ac..23d0ced 100644
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
   static void channel_swdemux_tsklet(unsigned long data)
   {
   	struct channel_info *channel = (struct channel_info *)data;
-	struct c8sectpfei *fei = channel->fei;
+	struct c8sectpfei *fei;
   	unsigned long wp, rp;
   	int pos, num_packets, n, size;
   	u8 *buf;
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c static void channel_swdemux_tsklet(unsigned long data) · line 98
Quoted 8 lines
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +2 -0
@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
   	if (unlikely(!channel || !channel->irec))
   		return;
 
+	fei = channel->fei;
+
   	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
   	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
 
Acked-by Patrice Chotard <[email protected]>

Quoted 1 line

Thanks

Thank you, Patrice.

--
Gustavo A. R. Silva

Gustavo A. R. Silva

author

2017-12-05 17:27 UTC #3 lore raw

In reply to Patrice CHOTARD

Hello,

Quoted 40 lines · Patrice CHOTARD

Hi Gustavo
Quoted 27 lines · Gustavo A. R. Silva
_channel_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer dereference after _channel_ has been null checked.
This issue was detected with the help of Coccinelle.
Fixes c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
   drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
   1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +1 -1
index 59280ac..23d0ced 100644
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
   static void channel_swdemux_tsklet(unsigned long data)
   {
   	struct channel_info *channel = (struct channel_info *)data;
-	struct c8sectpfei *fei = channel->fei;
+	struct c8sectpfei *fei;
   	unsigned long wp, rp;
   	int pos, num_packets, n, size;
   	u8 *buf;
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c static void channel_swdemux_tsklet(unsigned long data) · line 98
Quoted 8 lines
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +2 -0
@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
   	if (unlikely(!channel || !channel->irec))
   		return;
 
+	fei = channel->fei;
+
   	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
   	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
 
Acked-by Patrice Chotard <[email protected]>

Quoted 1 line

Thanks

Thank you, Patrice.

--
Gustavo A. R. Silva