From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam02on0127.outbound.protection.outlook.com ([104.47.36.127]:37136 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032331AbeCAPc5 (ORCPT ); Thu, 1 Mar 2018 10:32:57 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: "Gustavo A. R. Silva" , "Martin K . Petersen" , Sasha Levin Subject: [added to the 4.1 stable tree] scsi: ufs: ufshcd: fix potential NULL pointer dereference in ufshcd_config_vreg Date: Thu, 1 Mar 2018 15:25:32 +0000 Message-ID: <20180301152116.1486-277-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: "Gustavo A. R. Silva" This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit 727535903bea924c4f73abb202c4b3e85fff0ca4 ] _vreg_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer dereference after _vreg_ has been null checked. This issue was detected with the help of Coccinelle. Fixes: aa4976130934 ("ufs: Add regulator enable support") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Subhash Jadavani Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/ufs/ufshcd.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index 648a44675880..05b76cdfb263 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -4290,12 +4290,15 @@ static int ufshcd_config_vreg(struct device *dev, struct ufs_vreg *vreg, bool on) { int ret =3D 0; - struct regulator *reg =3D vreg->reg; - const char *name =3D vreg->name; + struct regulator *reg; + const char *name; int min_uV, uA_load; =20 BUG_ON(!vreg); =20 + reg =3D vreg->reg; + name =3D vreg->name; + if (regulator_count_voltages(reg) > 0) { min_uV =3D on ? vreg->min_uV : 0; ret =3D regulator_set_voltage(reg, min_uV, vreg->max_uV); --=20 2.14.1