linux-kernel - Re: [PATCH 2/2] [media] cec: Fix runtime BUG when (CONFIG_RC_CORE && !CEC_CAP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 4 Apr 2017 13:55:41 +0100
From:   Lee Jones <lee.jones@...aro.org>
To:     Hans Verkuil <hverkuil@...all.nl>
Cc:     hans.verkuil@...co.com, mchehab@...nel.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        kernel@...inux.com, patrice.chotard@...com,
        linux-media@...r.kernel.org, benjamin.gaignard@...com
Subject: Re: [PATCH 2/2] [media] cec: Fix runtime BUG when (CONFIG_RC_CORE &&
 !CEC_CAP_RC)

On Tue, 04 Apr 2017, Hans Verkuil wrote:

> On 04/04/2017 02:32 PM, Lee Jones wrote:
> > Currently when the RC Core is enabled (reachable) core code located
> > in cec_register_adapter() attempts to populate the RC structure with
> > a pointer to the 'parent' passed in by the caller.
> > 
> > Unfortunately if the caller did not specify RC capibility when calling
> > cec_allocate_adapter(), then there will be no RC structure to populate.
> > 
> > This causes a "NULL pointer dereference" error.
> > 
> > Fixes: f51e80804f0 ("[media] cec: pass parent device in register(), not allocate()")
> > Signed-off-by: Lee Jones <lee.jones@...aro.org>
> 
> Oops! Thanks for the report. I'll take this for 4.12.

Since this is a -fix, it should really go in for v4.11.

> > ---
> >  drivers/media/cec/cec-core.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/media/cec/cec-core.c b/drivers/media/cec/cec-core.c
> > index 06a312c..d64937b 100644
> > --- a/drivers/media/cec/cec-core.c
> > +++ b/drivers/media/cec/cec-core.c
> > @@ -286,8 +286,8 @@ int cec_register_adapter(struct cec_adapter *adap,
> >  	adap->devnode.dev.parent = parent;
> >  
> >  #if IS_REACHABLE(CONFIG_RC_CORE)
> > -	adap->rc->dev.parent = parent;
> >  	if (adap->capabilities & CEC_CAP_RC) {
> > +		adap->rc->dev.parent = parent;
> >  		res = rc_register_device(adap->rc);
> >  
> >  		if (res) {
> > 
> 

-- 
Lee Jones
Linaro STMicroelectronics Landing Team Lead
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog