All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-20 14:00 ` Gustavo A. R. Silva
  0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-20 14:00 UTC (permalink / raw)
  To: linux-arm-kernel

_channel_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference. Fix this by moving the pointer dereference
after _channel_ has been null checked.

This issue was detected with the help of Coccinelle.

Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
 drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
index 59280ac..23d0ced 100644
--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
 static void channel_swdemux_tsklet(unsigned long data)
 {
 	struct channel_info *channel = (struct channel_info *)data;
-	struct c8sectpfei *fei = channel->fei;
+	struct c8sectpfei *fei;
 	unsigned long wp, rp;
 	int pos, num_packets, n, size;
 	u8 *buf;
@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
 	if (unlikely(!channel || !channel->irec))
 		return;
 
+	fei = channel->fei;
+
 	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
 	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
 
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 8+ messages in thread
* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-20 14:00 ` Gustavo A. R. Silva
  0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-20 14:00 UTC (permalink / raw)
  To: Patrice Chotard, Mauro Carvalho Chehab
  Cc: linux-arm-kernel, linux-media, linux-kernel, Gustavo A. R. Silva

_channel_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference. Fix this by moving the pointer dereference
after _channel_ has been null checked.

This issue was detected with the help of Coccinelle.

Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
 drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
index 59280ac..23d0ced 100644
--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
 static void channel_swdemux_tsklet(unsigned long data)
 {
 	struct channel_info *channel = (struct channel_info *)data;
-	struct c8sectpfei *fei = channel->fei;
+	struct c8sectpfei *fei;
 	unsigned long wp, rp;
 	int pos, num_packets, n, size;
 	u8 *buf;
@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
 	if (unlikely(!channel || !channel->irec))
 		return;
 
+	fei = channel->fei;
+
 	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
 	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
 
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 8+ messages in thread
* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
  2017-11-20 14:00 ` Gustavo A. R. Silva
@ 2017-11-21  8:22   ` Patrice CHOTARD
  -1 siblings, 0 replies; 8+ messages in thread
From: Patrice CHOTARD @ 2017-11-21  8:22 UTC (permalink / raw)
  To: linux-arm-kernel

Hi Gustavo

On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
> _channel_ is being dereferenced before it is null checked, hence there is a
> potential null pointer dereference. Fix this by moving the pointer dereference
> after _channel_ has been null checked.
> 
> This issue was detected with the help of Coccinelle.
> 
> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
>   drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> index 59280ac..23d0ced 100644
> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>   static void channel_swdemux_tsklet(unsigned long data)
>   {
>   	struct channel_info *channel = (struct channel_info *)data;
> -	struct c8sectpfei *fei = channel->fei;
> +	struct c8sectpfei *fei;
>   	unsigned long wp, rp;
>   	int pos, num_packets, n, size;
>   	u8 *buf;
> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>   	if (unlikely(!channel || !channel->irec))
>   		return;
>   
> +	fei = channel->fei;
> +
>   	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>   	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>   
> 

Acked-by: Patrice Chotard <patrice.chotard@st.com>

Thanks

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-21  8:22   ` Patrice CHOTARD
  0 siblings, 0 replies; 8+ messages in thread
From: Patrice CHOTARD @ 2017-11-21  8:22 UTC (permalink / raw)
  To: Gustavo A. R. Silva, Mauro Carvalho Chehab
  Cc: linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org,
	linux-kernel@vger.kernel.org

Hi Gustavo

On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
> _channel_ is being dereferenced before it is null checked, hence there is a
> potential null pointer dereference. Fix this by moving the pointer dereference
> after _channel_ has been null checked.
> 
> This issue was detected with the help of Coccinelle.
> 
> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
>   drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> index 59280ac..23d0ced 100644
> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>   static void channel_swdemux_tsklet(unsigned long data)
>   {
>   	struct channel_info *channel = (struct channel_info *)data;
> -	struct c8sectpfei *fei = channel->fei;
> +	struct c8sectpfei *fei;
>   	unsigned long wp, rp;
>   	int pos, num_packets, n, size;
>   	u8 *buf;
> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>   	if (unlikely(!channel || !channel->irec))
>   		return;
>   
> +	fei = channel->fei;
> +
>   	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>   	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>   
> 

Acked-by: Patrice Chotard <patrice.chotard@st.com>

Thanks

^ permalink raw reply	[flat|nested] 8+ messages in thread
* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
  2017-11-21  8:22   ` Patrice CHOTARD
@ 2017-11-22 14:21     ` Gustavo A. R. Silva
  -1 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-22 14:21 UTC (permalink / raw)
  To: linux-arm-kernel


On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>>    drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>>    static void channel_swdemux_tsklet(unsigned long data)
>>    {
>>    	struct channel_info *channel = (struct channel_info *)data;
>> -	struct c8sectpfei *fei = channel->fei;
>> +	struct c8sectpfei *fei;
>>    	unsigned long wp, rp;
>>    	int pos, num_packets, n, size;
>>    	u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>>    	if (unlikely(!channel || !channel->irec))
>>    		return;
>>    
>> +	fei = channel->fei;
>> +
>>    	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>>    	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>    
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks

Thank you, Patrice.

--
Gustavo A. R. Silva

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-22 14:21     ` Gustavo A. R. Silva
  0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-22 14:21 UTC (permalink / raw)
  To: Patrice CHOTARD, Mauro Carvalho Chehab
  Cc: linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org,
	linux-kernel@vger.kernel.org


On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>>    drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>>    static void channel_swdemux_tsklet(unsigned long data)
>>    {
>>    	struct channel_info *channel = (struct channel_info *)data;
>> -	struct c8sectpfei *fei = channel->fei;
>> +	struct c8sectpfei *fei;
>>    	unsigned long wp, rp;
>>    	int pos, num_packets, n, size;
>>    	u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>>    	if (unlikely(!channel || !channel->irec))
>>    		return;
>>    
>> +	fei = channel->fei;
>> +
>>    	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>>    	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>    
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks

Thank you, Patrice.

--
Gustavo A. R. Silva

^ permalink raw reply	[flat|nested] 8+ messages in thread
* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
  2017-11-21  8:22   ` Patrice CHOTARD
@ 2017-12-05 17:27     ` Gustavo A. R. Silva
  -1 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-12-05 17:27 UTC (permalink / raw)
  To: linux-arm-kernel

Hello,

On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>>    drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>>    static void channel_swdemux_tsklet(unsigned long data)
>>    {
>>    	struct channel_info *channel = (struct channel_info *)data;
>> -	struct c8sectpfei *fei = channel->fei;
>> +	struct c8sectpfei *fei;
>>    	unsigned long wp, rp;
>>    	int pos, num_packets, n, size;
>>    	u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>>    	if (unlikely(!channel || !channel->irec))
>>    		return;
>>    
>> +	fei = channel->fei;
>> +
>>    	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>>    	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>    
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks

Thank you, Patrice.

--
Gustavo A. R. Silva

^ permalink raw reply	[flat|nested] 8+ messages in thread
* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-12-05 17:27     ` Gustavo A. R. Silva
  0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-12-05 17:27 UTC (permalink / raw)
  To: Patrice CHOTARD, Mauro Carvalho Chehab
  Cc: linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org,
	linux-kernel@vger.kernel.org

Hello,

On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>>    drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>>    static void channel_swdemux_tsklet(unsigned long data)
>>    {
>>    	struct channel_info *channel = (struct channel_info *)data;
>> -	struct c8sectpfei *fei = channel->fei;
>> +	struct c8sectpfei *fei;
>>    	unsigned long wp, rp;
>>    	int pos, num_packets, n, size;
>>    	u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>>    	if (unlikely(!channel || !channel->irec))
>>    		return;
>>    
>> +	fei = channel->fei;
>> +
>>    	wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>>    	rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>    
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks

Thank you, Patrice.

--
Gustavo A. R. Silva

^ permalink raw reply	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2017-12-05 17:27 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-11-20 14:00 [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Gustavo A. R. Silva
2017-11-20 14:00 ` Gustavo A. R. Silva
2017-11-21  8:22 ` Patrice CHOTARD
2017-11-21  8:22   ` Patrice CHOTARD
2017-11-22 14:21   ` Gustavo A. R. Silva
2017-11-22 14:21     ` Gustavo A. R. Silva
2017-12-05 17:27   ` Gustavo A. R. Silva
2017-12-05 17:27     ` Gustavo A. R. Silva

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.