Skip to contentSkip to conversation

media: rcar-vin: add group allocator functions

bug report Dan Carpenter 2 participants 2 messages May 3, 2018 Media (V4L/DVB)

lore
Share & tools
lore
#0 lore raw

Hello Niklas S�derlund,

The patch 3bb4c3bc85bf: "media: rcar-vin: add group allocator functions" from Apr 14, 2018, leads to the following static checker warning:

	drivers/media/platform/rcar-vin/rcar-core.c:346 rvin_group_put()
	error: potential NULL dereference 'vin->group'.

drivers/media/platform/rcar-vin/rcar-core.c
339 static void rvin_group_put(struct rvin_dev *vin) 340 {
341 mutex_lock(&vin->group->lock);
342

   343          vin->group = NULL;
                ^^^^^^^^^^^^^^^^^

Set to NULL.

   344          vin->v4l2_dev.mdev = NULL;
   345  
   346          if (WARN_ON(vin->group->vin[vin->id] != vin))
                            ^^^^^^^^^^^^^^^^^^^^^^^^
   347                  goto out;
   348  
   349          vin->group->vin[vin->id] = NULL;
                ^^^^^^^^^^^^^^^^^^^^^^^^
   350  out:
   351          mutex_unlock(&vin->group->lock);
                              ^^^^^^^^^^^^^^^^
   352  
   353          kref_put(&vin->group->refcount, rvin_group_release);
                          ^^^^^^^^^^^^^^^^^^^^

There are a bunch of NULL dereferences here...

354 }

regards,
dan carpenter

#1 lore raw

Hi Dan,

Thanks for your report. A proposed fix to this is available [1], awaiting inclusion in the media-tree :-)

1. https://patchwork.linuxtv.org/patch/49025/

Quoted 39 lines · Dan Carpenter

Hello Niklas S�derlund,

The patch 3bb4c3bc85bf: "media: rcar-vin: add group allocator functions" from Apr 14, 2018, leads to the following static checker warning:

	drivers/media/platform/rcar-vin/rcar-core.c:346 rvin_group_put()
	error: potential NULL dereference 'vin->group'.

drivers/media/platform/rcar-vin/rcar-core.c
339 static void rvin_group_put(struct rvin_dev *vin)

   340  {
   341          mutex_lock(&vin->group->lock);
   342  
   343          vin->group = NULL;
                ^^^^^^^^^^^^^^^^^

Set to NULL.

   344          vin->v4l2_dev.mdev = NULL;
   345  
   346          if (WARN_ON(vin->group->vin[vin->id] != vin))
                            ^^^^^^^^^^^^^^^^^^^^^^^^
   347                  goto out;
   348  
   349          vin->group->vin[vin->id] = NULL;
                ^^^^^^^^^^^^^^^^^^^^^^^^
   350  out:
   351          mutex_unlock(&vin->group->lock);
                              ^^^^^^^^^^^^^^^^
   352  
   353          kref_put(&vin->group->refcount, rvin_group_release);
                          ^^^^^^^^^^^^^^^^^^^^

There are a bunch of NULL dereferences here...

   354  }

regards,
dan carpenter

Signature · 2 lines
Regards,
Niklas S�derlund