linux-kernel - Re: [PATCH v4] i2c: busses: i2c-pxa.c: Fix for possible null pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 16 Aug 2014 23:32:16 +0200
From:	Rickard Strandqvist <rickard_strandqvist@...ctrumdigital.se>
To:	Wolfram Sang <wsa@...-dreams.de>
Cc:	Grant Likely <grant.likely@...aro.org>,
	Rob Herring <robh+dt@...nel.org>,
	Jingoo Han <jg1.han@...sung.com>,
	Leilei Shang <shangll@...vell.com>,
	Peter Korsgaard <peter@...sgaard.com>,
	linux-i2c@...r.kernel.org,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"devicetree@...r.kernel.org" <devicetree@...r.kernel.org>
Subject: Re: [PATCH v4] i2c: busses: i2c-pxa.c: Fix for possible null pointer dereference

2014-08-02 13:30 GMT+02:00 Wolfram Sang <wsa@...-dreams.de>:
> Hi,
>
>>       res = platform_get_resource(dev, IORESOURCE_MEM, 0);
>>       irq = platform_get_irq(dev, 0);
>> -     if (res == NULL || irq < 0) {
>> -             ret = -ENODEV;
>> -             goto eclk;
>> -     }
>> +     if (res == NULL || irq < 0)
>> +             return -ENODEV;
>
> No need to check for valid 'res' here...
>
>>
>> -     if (!request_mem_region(res->start, resource_size(res), res->name)) {
>> -             ret = -ENOMEM;
>> -             goto eclk;
>> -     }
>> +     if (!devm_request_mem_region(&dev->dev, res->start,
>> +                             resource_size(res), res->name))
>> +             return -ENOMEM;
>
> ... and no need to use 'devm_request_mem_region' ...
>
>> -     i2c->reg_base = ioremap(res->start, resource_size(res));
>> -     if (!i2c->reg_base) {
>> -             ret = -EIO;
>> -             goto eremap;
>> -     }
>> +     i2c->reg_base = devm_ioremap_resource(&adev->dev, res));
>> +     if (IS_ERR(i2c->reg_base))
>> +             return -EIO;
>
> ... because devm_ioremap_resource does all that for you. Also, don't
> return -EIO but the PTR_ERR given from the function. Just check other
> drivers how they do it.
>
>>
>>       i2c->reg_ibmr = i2c->reg_base + pxa_reg_layout[i2c_type].ibmr;
>>       i2c->reg_idbr = i2c->reg_base + pxa_reg_layout[i2c_type].idbr;
>> @@ -1227,10 +1218,12 @@ static int i2c_pxa_probe(struct platform_device *dev)
>>               i2c->adap.algo = &i2c_pxa_pio_algorithm;
>>       } else {
>>               i2c->adap.algo = &i2c_pxa_algorithm;
>> -             ret = request_irq(irq, i2c_pxa_handler, IRQF_SHARED,
>> -                               dev_name(&dev->dev), i2c);
>> -             if (ret)
>> -                     goto ereqirq;
>> +             ret = devm_request_irq(&dev->dev, irq, i2c_pxa_handler,
>> +                              IRQF_SHARED, dev_name(&dev->dev), i2c);
>> +             if (ret) {
>> +                     clk_disable_unprepare(i2c->clk);
>> +                     return ret;
>
> Maybe you should make a error path with 'goto' out of it...
>
>
>> +             }
>>       }
>>
>>       i2c_pxa_reset(i2c);
>> @@ -1244,7 +1237,7 @@ static int i2c_pxa_probe(struct platform_device *dev)
>>       ret = i2c_add_numbered_adapter(&i2c->adap);
>>       if (ret < 0) {
>>               printk(KERN_INFO "I2C: Failed to add bus\n");
>> -             goto eadapt;
>> +             return ret;
>
> ... since you forgot disable_unprepare here and could simply reuse it.
>
>
>>       }
>>
>>       platform_set_drvdata(dev, i2c);
>> @@ -1257,20 +1250,6 @@ static int i2c_pxa_probe(struct platform_device *dev)
>>              dev_name(&i2c->adap.dev));
>>  #endif
>>       return 0;
>> -
>> -eadapt:
>> -     if (!i2c->use_pio)
>> -             free_irq(irq, i2c);
>> -ereqirq:
>> -     clk_disable_unprepare(i2c->clk);
>> -     iounmap(i2c->reg_base);
>> -eremap:
>> -     clk_put(i2c->clk);
>> -eclk:
>> -     kfree(i2c);
>> -emalloc:
>> -     release_mem_region(res->start, resource_size(res));
>> -     return ret;
>>  }
>
> You forgot to cleanup the remove function.
>
> BTW I forgot, can you test this patch on real hardware? If not, is there
> somebody who does?
>
> All the best,
>
>    Wolfram



Hi

I have made a lot of changes on changes to changes, and have really
tried to ensure that all would be right.

But I feel like that's enough, Wolfram or anyone else may end this.

And no as I replied earlier, I lack this kind of hardware...


Kind regards
Rickard Strandqvist
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/