* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-20 14:00 ` Gustavo A. R. Silva
0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-20 14:00 UTC (permalink / raw)
To: linux-arm-kernel
_channel_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference. Fix this by moving the pointer dereference
after _channel_ has been null checked.
This issue was detected with the help of Coccinelle.
Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
index 59280ac..23d0ced 100644
--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
static void channel_swdemux_tsklet(unsigned long data)
{
struct channel_info *channel = (struct channel_info *)data;
- struct c8sectpfei *fei = channel->fei;
+ struct c8sectpfei *fei;
unsigned long wp, rp;
int pos, num_packets, n, size;
u8 *buf;
@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
if (unlikely(!channel || !channel->irec))
return;
+ fei = channel->fei;
+
wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
--
2.7.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-20 14:00 ` Gustavo A. R. Silva
0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-20 14:00 UTC (permalink / raw)
To: Patrice Chotard, Mauro Carvalho Chehab
Cc: linux-arm-kernel, linux-media, linux-kernel, Gustavo A. R. Silva
_channel_ is being dereferenced before it is null checked, hence there is a
potential null pointer dereference. Fix this by moving the pointer dereference
after _channel_ has been null checked.
This issue was detected with the help of Coccinelle.
Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
---
drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
index 59280ac..23d0ced 100644
--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
static void channel_swdemux_tsklet(unsigned long data)
{
struct channel_info *channel = (struct channel_info *)data;
- struct c8sectpfei *fei = channel->fei;
+ struct c8sectpfei *fei;
unsigned long wp, rp;
int pos, num_packets, n, size;
u8 *buf;
@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
if (unlikely(!channel || !channel->irec))
return;
+ fei = channel->fei;
+
wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
--
2.7.4
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
2017-11-20 14:00 ` Gustavo A. R. Silva
@ 2017-11-21 8:22 ` Patrice CHOTARD
-1 siblings, 0 replies; 8+ messages in thread
From: Patrice CHOTARD @ 2017-11-21 8:22 UTC (permalink / raw)
To: linux-arm-kernel
Hi Gustavo
On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
> _channel_ is being dereferenced before it is null checked, hence there is a
> potential null pointer dereference. Fix this by moving the pointer dereference
> after _channel_ has been null checked.
>
> This issue was detected with the help of Coccinelle.
>
> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> index 59280ac..23d0ced 100644
> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
> static void channel_swdemux_tsklet(unsigned long data)
> {
> struct channel_info *channel = (struct channel_info *)data;
> - struct c8sectpfei *fei = channel->fei;
> + struct c8sectpfei *fei;
> unsigned long wp, rp;
> int pos, num_packets, n, size;
> u8 *buf;
> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
> if (unlikely(!channel || !channel->irec))
> return;
>
> + fei = channel->fei;
> +
> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>
>
Acked-by: Patrice Chotard <patrice.chotard@st.com>
Thanks
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-21 8:22 ` Patrice CHOTARD
0 siblings, 0 replies; 8+ messages in thread
From: Patrice CHOTARD @ 2017-11-21 8:22 UTC (permalink / raw)
To: Gustavo A. R. Silva, Mauro Carvalho Chehab
Cc: linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org,
linux-kernel@vger.kernel.org
Hi Gustavo
On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
> _channel_ is being dereferenced before it is null checked, hence there is a
> potential null pointer dereference. Fix this by moving the pointer dereference
> after _channel_ has been null checked.
>
> This issue was detected with the help of Coccinelle.
>
> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
> ---
> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> index 59280ac..23d0ced 100644
> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
> static void channel_swdemux_tsklet(unsigned long data)
> {
> struct channel_info *channel = (struct channel_info *)data;
> - struct c8sectpfei *fei = channel->fei;
> + struct c8sectpfei *fei;
> unsigned long wp, rp;
> int pos, num_packets, n, size;
> u8 *buf;
> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
> if (unlikely(!channel || !channel->irec))
> return;
>
> + fei = channel->fei;
> +
> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>
>
Acked-by: Patrice Chotard <patrice.chotard@st.com>
Thanks
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
2017-11-21 8:22 ` Patrice CHOTARD
@ 2017-11-22 14:21 ` Gustavo A. R. Silva
-1 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-22 14:21 UTC (permalink / raw)
To: linux-arm-kernel
On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>> static void channel_swdemux_tsklet(unsigned long data)
>> {
>> struct channel_info *channel = (struct channel_info *)data;
>> - struct c8sectpfei *fei = channel->fei;
>> + struct c8sectpfei *fei;
>> unsigned long wp, rp;
>> int pos, num_packets, n, size;
>> u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>> if (unlikely(!channel || !channel->irec))
>> return;
>>
>> + fei = channel->fei;
>> +
>> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks
Thank you, Patrice.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-11-22 14:21 ` Gustavo A. R. Silva
0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-11-22 14:21 UTC (permalink / raw)
To: Patrice CHOTARD, Mauro Carvalho Chehab
Cc: linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org,
linux-kernel@vger.kernel.org
On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>> static void channel_swdemux_tsklet(unsigned long data)
>> {
>> struct channel_info *channel = (struct channel_info *)data;
>> - struct c8sectpfei *fei = channel->fei;
>> + struct c8sectpfei *fei;
>> unsigned long wp, rp;
>> int pos, num_packets, n, size;
>> u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>> if (unlikely(!channel || !channel->irec))
>> return;
>>
>> + fei = channel->fei;
>> +
>> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks
Thank you, Patrice.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
2017-11-21 8:22 ` Patrice CHOTARD
@ 2017-12-05 17:27 ` Gustavo A. R. Silva
-1 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-12-05 17:27 UTC (permalink / raw)
To: linux-arm-kernel
Hello,
On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>> static void channel_swdemux_tsklet(unsigned long data)
>> {
>> struct channel_info *channel = (struct channel_info *)data;
>> - struct c8sectpfei *fei = channel->fei;
>> + struct c8sectpfei *fei;
>> unsigned long wp, rp;
>> int pos, num_packets, n, size;
>> u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>> if (unlikely(!channel || !channel->irec))
>> return;
>>
>> + fei = channel->fei;
>> +
>> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks
Thank you, Patrice.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt
@ 2017-12-05 17:27 ` Gustavo A. R. Silva
0 siblings, 0 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2017-12-05 17:27 UTC (permalink / raw)
To: Patrice CHOTARD, Mauro Carvalho Chehab
Cc: linux-arm-kernel@lists.infradead.org, linux-media@vger.kernel.org,
linux-kernel@vger.kernel.org
Hello,
On 11/21/2017 02:22 AM, Patrice CHOTARD wrote:
> Hi Gustavo
>
> On 11/20/2017 03:00 PM, Gustavo A. R. Silva wrote:
>> _channel_ is being dereferenced before it is null checked, hence there is a
>> potential null pointer dereference. Fix this by moving the pointer dereference
>> after _channel_ has been null checked.
>>
>> This issue was detected with the help of Coccinelle.
>>
>> Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support")
>> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
>> ---
>> drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> index 59280ac..23d0ced 100644
>> --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
>> @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei)
>> static void channel_swdemux_tsklet(unsigned long data)
>> {
>> struct channel_info *channel = (struct channel_info *)data;
>> - struct c8sectpfei *fei = channel->fei;
>> + struct c8sectpfei *fei;
>> unsigned long wp, rp;
>> int pos, num_packets, n, size;
>> u8 *buf;
>> @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data)
>> if (unlikely(!channel || !channel->irec))
>> return;
>>
>> + fei = channel->fei;
>> +
>> wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0));
>> rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0));
>>
>>
> Acked-by: Patrice Chotard <patrice.chotard@st.com>
>
> Thanks
Thank you, Patrice.
--
Gustavo A. R. Silva
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2017-12-05 17:27 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-11-20 14:00 [PATCH] c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Gustavo A. R. Silva
2017-11-20 14:00 ` Gustavo A. R. Silva
2017-11-21 8:22 ` Patrice CHOTARD
2017-11-21 8:22 ` Patrice CHOTARD
2017-11-22 14:21 ` Gustavo A. R. Silva
2017-11-22 14:21 ` Gustavo A. R. Silva
2017-12-05 17:27 ` Gustavo A. R. Silva
2017-12-05 17:27 ` Gustavo A. R. Silva
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.