Skip to contentSkip to conversation

scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg

PATCH Applied Gustavo A. R. Silva 3 participants 4 messages Nov 20, 2017 – Nov 22, 2017 SCSI

lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg

_vreg_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference.

Fix this by moving the pointer dereference after _vreg_ has been null checked.

This issue was detected with the help of Coccinelle.

Fixes aa4976130934 ("ufs: Add regulator enable support")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/scsi/ufs/ufshcd.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/scsi/ufs/ufshcd.c +5 -2
index 011c336..a355d98 100644
@@ -6559,12 +6559,15 @@ static int ufshcd_config_vreg(struct device *dev,
 		struct ufs_vreg *vreg, bool on)
 {
 	int ret = 0;
-	struct regulator *reg = vreg->reg;
-	const char *name = vreg->name;
+	struct regulator *reg;
+	const char *name;
 	int min_uV, uA_load;
 
 	BUG_ON(!vreg);
 
+	reg = vreg->reg;
+	name = vreg->name;
+
 	if (regulator_count_voltages(reg) > 0) {
 		min_uV = on ? vreg->min_uV : 0;
 		ret = regulator_set_voltage(reg, min_uV, vreg->max_uV);
Signature · 1 line
2.7.4
Reviewed-by on v1 1/1
#1 lore raw
Quoted 36 lines · Gustavo A. R. Silva

_vreg_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference.

Fix this by moving the pointer dereference after _vreg_ has been null checked.

This issue was detected with the help of Coccinelle.

Fixes aa4976130934 ("ufs: Add regulator enable support")
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/scsi/ufs/ufshcd.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/scsi/ufs/ufshcd.c +5 -2
index 011c336..a355d98 100644
@@ -6559,12 +6559,15 @@ static int ufshcd_config_vreg(struct device 
 *dev,
 		struct ufs_vreg *vreg, bool on)
 {
 	int ret = 0;
-	struct regulator *reg = vreg->reg;
-	const char *name = vreg->name;
+	struct regulator *reg;
+	const char *name;
 	int min_uV, uA_load;
 
 	BUG_ON(!vreg);
 
+	reg = vreg->reg;
+	name = vreg->name;
+
 	if (regulator_count_voltages(reg) > 0) {
 		min_uV = on ? vreg->min_uV : 0;
Quoted 1 line

ret = regulator_set_voltage(reg, min_uV, vreg->max_uV);

Looks good to me.

Reviewed-by Subhash Jadavani <[email protected]>
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
Applied
#2 lore raw
In reply to Gustavo A. R. Silva

Gustavo A.,

Quoted 5 lines

_vreg_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference.

Fix this by moving the pointer dereference after _vreg_ has been null checked.

Applied to 4.15/scsi-fixes, thank you!

Signature · 1 line
Martin K. Petersen	Oracle Linux Engineering
author
#3 lore raw
Quoted 9 lines · Martin K. Petersen

Gustavo A.,

Quoted 5 lines

_vreg_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference.

Fix this by moving the pointer dereference after _vreg_ has been null checked.

Applied to 4.15/scsi-fixes, thank you!

Glad to help. :)

Thanks
--
Gustavo A. R. Silva