All of lore.kernel.org
 help / color / mirror / Atom feed
From: Drew Fustini <dfustini@tenstorrent.com>
To: clingfei <clf700383@gmail.com>
Cc: drew@pdp7.com, guoren@kernel.org, wefu@redhat.com,
	linus.walleij@linaro.org, linux-riscv@lists.infradead.org,
	linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] pinctrl: fix Null pointer dereference
Date: Wed, 2 Oct 2024 19:56:21 -0700	[thread overview]
Message-ID: <Zv4H1cl3aH9wnapH@x1> (raw)
In-Reply-To: <20241003023307.2138695-1-clf700383@gmail.com>

On Thu, Oct 03, 2024 at 10:33:07AM +0800, clingfei wrote:
> pinmux_generic_get_function may returns NULL, and its retval is
> dereferenced without check, which will cause a null pointer dereference.
> 
> Signed-off-by: clingfei <clf700383@gmail.com>
> ---
>  drivers/pinctrl/pinctrl-th1520.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/pinctrl/pinctrl-th1520.c b/drivers/pinctrl/pinctrl-th1520.c
> index 1bb78b212fd5..9331f4462480 100644
> --- a/drivers/pinctrl/pinctrl-th1520.c
> +++ b/drivers/pinctrl/pinctrl-th1520.c
> @@ -798,6 +798,8 @@ static int th1520_pinmux_set_mux(struct pinctrl_dev *pctldev,
>  	struct th1520_pinctrl *thp = pinctrl_dev_get_drvdata(pctldev);
>  	const struct function_desc *func = pinmux_generic_get_function(pctldev, fsel);
>  
> +	if (!func)
> +		return -EINVAL;
>  	return th1520_pinmux_set(thp, thp->desc.pins[gsel].number,
>  				 (uintptr_t)thp->desc.pins[gsel].drv_data & TH1520_PAD_MUXDATA,
>  				 (uintptr_t)func->data);
> -- 
> 2.34.1

Thanks for fixing the formating in the previous attempt.

As Kees Bakker noted [1], I failed to have this check in my v3 patch
series. This fix makes pinctrl-th1520 behave the same as other drivers
that call pinmux_generic_get_function() like pinctrl-single. I have
applied your patch and the driver still works as expected on my LPi4a.

Hopefully Linus can apply this fix on top of my v3 series.

Reviewed-by: Drew Fustini <dfustini@tenstorrent.com>

-Drew

[1] https://lore.kernel.org/lkml/87770518-5f63-4adf-b6ea-c7f92b58ce22@ijzerbout.nl/

WARNING: multiple messages have this Message-ID (diff)
From: Drew Fustini <dfustini@tenstorrent.com>
To: clingfei <clf700383@gmail.com>
Cc: drew@pdp7.com, guoren@kernel.org, wefu@redhat.com,
	linus.walleij@linaro.org, linux-riscv@lists.infradead.org,
	linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] pinctrl: fix Null pointer dereference
Date: Wed, 2 Oct 2024 19:56:21 -0700	[thread overview]
Message-ID: <Zv4H1cl3aH9wnapH@x1> (raw)
In-Reply-To: <20241003023307.2138695-1-clf700383@gmail.com>

On Thu, Oct 03, 2024 at 10:33:07AM +0800, clingfei wrote:
> pinmux_generic_get_function may returns NULL, and its retval is
> dereferenced without check, which will cause a null pointer dereference.
> 
> Signed-off-by: clingfei <clf700383@gmail.com>
> ---
>  drivers/pinctrl/pinctrl-th1520.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/pinctrl/pinctrl-th1520.c b/drivers/pinctrl/pinctrl-th1520.c
> index 1bb78b212fd5..9331f4462480 100644
> --- a/drivers/pinctrl/pinctrl-th1520.c
> +++ b/drivers/pinctrl/pinctrl-th1520.c
> @@ -798,6 +798,8 @@ static int th1520_pinmux_set_mux(struct pinctrl_dev *pctldev,
>  	struct th1520_pinctrl *thp = pinctrl_dev_get_drvdata(pctldev);
>  	const struct function_desc *func = pinmux_generic_get_function(pctldev, fsel);
>  
> +	if (!func)
> +		return -EINVAL;
>  	return th1520_pinmux_set(thp, thp->desc.pins[gsel].number,
>  				 (uintptr_t)thp->desc.pins[gsel].drv_data & TH1520_PAD_MUXDATA,
>  				 (uintptr_t)func->data);
> -- 
> 2.34.1

Thanks for fixing the formating in the previous attempt.

As Kees Bakker noted [1], I failed to have this check in my v3 patch
series. This fix makes pinctrl-th1520 behave the same as other drivers
that call pinmux_generic_get_function() like pinctrl-single. I have
applied your patch and the driver still works as expected on my LPi4a.

Hopefully Linus can apply this fix on top of my v3 series.

Reviewed-by: Drew Fustini <dfustini@tenstorrent.com>

-Drew

[1] https://lore.kernel.org/lkml/87770518-5f63-4adf-b6ea-c7f92b58ce22@ijzerbout.nl/

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

  reply	other threads:[~2024-10-03  2:56 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-10-03  2:33 [PATCH] pinctrl: fix Null pointer dereference clingfei
2024-10-03  2:33 ` clingfei
2024-10-03  2:56 ` Drew Fustini [this message]
2024-10-03  2:56   ` Drew Fustini
2024-10-03 14:08 ` Linus Walleij
2024-10-03 14:08   ` Linus Walleij
  -- strict thread matches above, loose matches on Subject: below --
2024-10-03  1:52 xi xi
2024-10-03  1:52 ` xi xi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Zv4H1cl3aH9wnapH@x1 \
    --to=dfustini@tenstorrent.com \
    --cc=clf700383@gmail.com \
    --cc=drew@pdp7.com \
    --cc=guoren@kernel.org \
    --cc=linus.walleij@linaro.org \
    --cc=linux-gpio@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=wefu@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.