[PATCH 0/2] ARM: imx: bug fix and convertion to platform_device_register_full()

[PATCH 0/2] ARM: imx: bug fix and convertion to platform_device_register_full()

[Emil Goode]

This small series fixes a potential NULL pointer dereference bug and
also converts the imx camera allocation and initialization functions
to use platform_device_register_full().

The change the first patch makes is removed by the second patch, so the
purpose of the first one is purely for easy backporting and git history.

Emil Goode (2):
  ARM: imx: fix error handling in ipu device registration
  ARM: imx: convert camera init to use platform_device_register_full()

 arch/arm/mach-imx/devices/platform-ipu-core.c |   43 +++++++++----------------
 arch/arm/mach-imx/mach-mx31_3ds.c             |    5 ++-
 arch/arm/mach-imx/mach-mx31moboard.c          |    6 ++--
 arch/arm/mach-imx/mach-mx35_3ds.c             |    5 ++-
 arch/arm/mach-imx/mach-pcm037.c               |    5 ++-
 5 files changed, 23 insertions(+), 41 deletions(-)

-- 
1.7.10.4

[PATCH 1/2 v4] ARM: imx: fix error handling in ipu device registration

[Emil Goode]

If we fail to allocate struct platform_device pdev we
dereference it after the goto label err.

This bug was found using coccinelle.

Signed-off-by: Emil Goode <emilgoode@gmail.com>
---
v4: Simplified version that just fixes the bug.
    Also updated the changelog.
v3: Made subject line more specific.
v2: Changed to return -ENOMEM instead of ret where possible and
    updated the subject line.

 arch/arm/mach-imx/devices/platform-ipu-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mach-imx/devices/platform-ipu-core.c b/arch/arm/mach-imx/devices/platform-ipu-core.c
index fc4dd7c..6bd7c3f 100644
--- a/arch/arm/mach-imx/devices/platform-ipu-core.c
+++ b/arch/arm/mach-imx/devices/platform-ipu-core.c
@@ -77,7 +77,7 @@ struct platform_device *__init imx_alloc_mx3_camera(
 
 	pdev = platform_device_alloc("mx3-camera", 0);
 	if (!pdev)
-		goto err;
+		return ERR_PTR(-ENOMEM);
 
 	pdev->dev.dma_mask = kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
 	if (!pdev->dev.dma_mask)
-- 
1.7.10.4

[PATCH 2/2] ARM: imx: convert camera init to use platform_device_register_full()

[Emil Goode]

This converts the imx camera allocation and initialization functions
to use platform_device_register_full() thus simplifying the code.

Signed-off-by: Emil Goode <emilgoode@gmail.com>
---
Only build tested, unfortunately I currently don't have the hardware.

 arch/arm/mach-imx/devices/platform-ipu-core.c |   43 +++++++++----------------
 arch/arm/mach-imx/mach-mx31_3ds.c             |    5 ++-
 arch/arm/mach-imx/mach-mx31moboard.c          |    6 ++--
 arch/arm/mach-imx/mach-mx35_3ds.c             |    5 ++-
 arch/arm/mach-imx/mach-pcm037.c               |    5 ++-
 5 files changed, 23 insertions(+), 41 deletions(-)

diff --git a/arch/arm/mach-imx/devices/platform-ipu-core.c b/arch/arm/mach-imx/devices/platform-ipu-core.c
index 6bd7c3f..13ea542 100644
--- a/arch/arm/mach-imx/devices/platform-ipu-core.c
+++ b/arch/arm/mach-imx/devices/platform-ipu-core.c
@@ -69,42 +69,29 @@ struct platform_device *__init imx_alloc_mx3_camera(
 			.flags = IORESOURCE_MEM,
 		},
 	};
-	int ret = -ENOMEM;
-	struct platform_device *pdev;
+	struct platform_device_info pdevinfo;
+	struct mx3_camera_pdata tmppdata;
 
 	if (IS_ERR_OR_NULL(imx_ipu_coredev))
 		return ERR_PTR(-ENODEV);
 
-	pdev = platform_device_alloc("mx3-camera", 0);
-	if (!pdev)
-		return ERR_PTR(-ENOMEM);
-
-	pdev->dev.dma_mask = kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
-	if (!pdev->dev.dma_mask)
-		goto err;
-
-	*pdev->dev.dma_mask = DMA_BIT_MASK(32);
-	pdev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
-
-	ret = platform_device_add_resources(pdev, res, ARRAY_SIZE(res));
-	if (ret)
-		goto err;
+	memset(&pdevinfo, 0, sizeof(pdevinfo));
+	pdevinfo.name = "mx3-camera";
+	pdevinfo.id = 0;
+	pdevinfo.res = res;
+	pdevinfo.num_res = ARRAY_SIZE(res);
+	pdevinfo.dma_mask = DMA_BIT_MASK(32);
 
 	if (pdata) {
-		struct mx3_camera_pdata *copied_pdata;
-
-		ret = platform_device_add_data(pdev, pdata, sizeof(*pdata));
-		if (ret) {
-err:
-			kfree(pdev->dev.dma_mask);
-			platform_device_put(pdev);
-			return ERR_PTR(-ENODEV);
-		}
-		copied_pdata = dev_get_platdata(&pdev->dev);
-		copied_pdata->dma_dev = &imx_ipu_coredev->dev;
+		tmppdata = *pdata;
+		tmppdata.dma_dev = &imx_ipu_coredev->dev;
+
+		pdata = &tmppdata;
+		pdevinfo.data = pdata;
+		pdevinfo.size_data = sizeof(*pdata);
 	}
 
-	return pdev;
+	return platform_device_register_full(&pdevinfo);
 }
 
 struct platform_device *__init imx_add_mx3_sdc_fb(
diff --git a/arch/arm/mach-imx/mach-mx31_3ds.c b/arch/arm/mach-imx/mach-mx31_3ds.c
index 4217871..a73a933 100644
--- a/arch/arm/mach-imx/mach-mx31_3ds.c
+++ b/arch/arm/mach-imx/mach-mx31_3ds.c
@@ -199,10 +199,9 @@ static int __init mx31_3ds_init_camera(void)
 	if (!(dma & DMA_MEMORY_MAP))
 		goto err;
 
-	ret = platform_device_add(pdev);
-	if (ret)
+	return 0;
 err:
-		platform_device_put(pdev);
+	platform_device_put(pdev);
 
 	return ret;
 }
diff --git a/arch/arm/mach-imx/mach-mx31moboard.c b/arch/arm/mach-imx/mach-mx31moboard.c
index 08730f2..14ca3b8 100644
--- a/arch/arm/mach-imx/mach-mx31moboard.c
+++ b/arch/arm/mach-imx/mach-mx31moboard.c
@@ -492,13 +492,11 @@ static int __init mx31moboard_init_cam(void)
 	if (!(dma & DMA_MEMORY_MAP))
 		goto err;
 
-	ret = platform_device_add(pdev);
-	if (ret)
+	return 0;
 err:
-		platform_device_put(pdev);
+	platform_device_put(pdev);
 
 	return ret;
-
 }
 
 static void mx31moboard_poweroff(void)
diff --git a/arch/arm/mach-imx/mach-mx35_3ds.c b/arch/arm/mach-imx/mach-mx35_3ds.c
index 4e8b184..c5a1b44 100644
--- a/arch/arm/mach-imx/mach-mx35_3ds.c
+++ b/arch/arm/mach-imx/mach-mx35_3ds.c
@@ -282,10 +282,9 @@ static int __init imx35_3ds_init_camera(void)
 	if (!(dma & DMA_MEMORY_MAP))
 		goto err;
 
-	ret = platform_device_add(pdev);
-	if (ret)
+	return 0;
 err:
-		platform_device_put(pdev);
+	platform_device_put(pdev);
 
 	return ret;
 }
diff --git a/arch/arm/mach-imx/mach-pcm037.c b/arch/arm/mach-imx/mach-pcm037.c
index 81b8aff..fa00e6d 100644
--- a/arch/arm/mach-imx/mach-pcm037.c
+++ b/arch/arm/mach-imx/mach-pcm037.c
@@ -425,10 +425,9 @@ static int __init pcm037_init_camera(void)
 	if (!(dma & DMA_MEMORY_MAP))
 		goto err;
 
-	ret = platform_device_add(pdev);
-	if (ret)
+	return 0;
 err:
-		platform_device_put(pdev);
+	platform_device_put(pdev);
 
 	return ret;
 }
-- 
1.7.10.4

[PATCH 2/2] ARM: imx: convert camera init to use platform_device_register_full()

[Uwe Kleine-König]

Hello Emil,

thanks for your effort.

On Sun, May 18, 2014 at 10:51:00PM +0200, Emil Goode wrote:
> This converts the imx camera allocation and initialization functions
> to use platform_device_register_full() thus simplifying the code.
> 
> Signed-off-by: Emil Goode <emilgoode@gmail.com>
> ---
> Only build tested, unfortunately I currently don't have the hardware.
> 
>  arch/arm/mach-imx/devices/platform-ipu-core.c |   43 +++++++++----------------
>  arch/arm/mach-imx/mach-mx31_3ds.c             |    5 ++-
>  arch/arm/mach-imx/mach-mx31moboard.c          |    6 ++--
>  arch/arm/mach-imx/mach-mx35_3ds.c             |    5 ++-
>  arch/arm/mach-imx/mach-pcm037.c               |    5 ++-
>  5 files changed, 23 insertions(+), 41 deletions(-)
> 
> diff --git a/arch/arm/mach-imx/devices/platform-ipu-core.c b/arch/arm/mach-imx/devices/platform-ipu-core.c
> index 6bd7c3f..13ea542 100644
> --- a/arch/arm/mach-imx/devices/platform-ipu-core.c
> +++ b/arch/arm/mach-imx/devices/platform-ipu-core.c
> @@ -69,42 +69,29 @@ struct platform_device *__init imx_alloc_mx3_camera(
IMHO you should better rename the function because now it doesn't only
allocate the device, but also registers it.

Also I doubt that it's OK to call dma_declare_coherent_memory after the
device is added. In this case maybe extend
platform_device_register_full? And also add a warning to
dma_declare_coherent_memory if it is called for an already added device?
(Added a few people to Cc: that might be able to comment this. I don't
even know if there is a reliable way to check if a device is already
added.)

Best regards
Uwe

-- 
Pengutronix e.K.                           | Uwe Kleine-K?nig            |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |

[PATCH 1/2 v4] ARM: imx: fix error handling in ipu device registration

[Uwe Kleine-König]

On Sun, May 18, 2014 at 10:50:59PM +0200, Emil Goode wrote:
> If we fail to allocate struct platform_device pdev we
> dereference it after the goto label err.
> 
> This bug was found using coccinelle.
> 
> Signed-off-by: Emil Goode <emilgoode@gmail.com>
Acked-by: Uwe Kleine-K?nig <u.kleine-koenig@pengutronix.de>

Shawn, is it already to late for 3.15?

Thanks
Uwe

-- 
Pengutronix e.K.                           | Uwe Kleine-K?nig            |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |

[PATCH 1/2 v4] ARM: imx: fix error handling in ipu device registration

[Shawn Guo]

On Mon, May 19, 2014 at 08:31:45AM +0200, Uwe Kleine-K?nig wrote:
> On Sun, May 18, 2014 at 10:50:59PM +0200, Emil Goode wrote:
> > If we fail to allocate struct platform_device pdev we
> > dereference it after the goto label err.
> > 
> > This bug was found using coccinelle.
> > 
> > Signed-off-by: Emil Goode <emilgoode@gmail.com>
> Acked-by: Uwe Kleine-K?nig <u.kleine-koenig@pengutronix.de>
> 
> Shawn, is it already to late for 3.15?

Let me try to see.

Shawn

[PATCH 2/2] ARM: imx: convert camera init to use platform_device_register_full()

[Emil Goode]

Hello Uwe,

Thank you for the review and sorry for the late response.

On Mon, May 19, 2014 at 08:27:22AM +0200, Uwe Kleine-K?nig wrote:
> Hello Emil,
> 
> thanks for your effort.
> 
> On Sun, May 18, 2014 at 10:51:00PM +0200, Emil Goode wrote:
> > This converts the imx camera allocation and initialization functions
> > to use platform_device_register_full() thus simplifying the code.
> > 
> > Signed-off-by: Emil Goode <emilgoode@gmail.com>
> > ---
> > Only build tested, unfortunately I currently don't have the hardware.
> > 
> >  arch/arm/mach-imx/devices/platform-ipu-core.c |   43 +++++++++----------------
> >  arch/arm/mach-imx/mach-mx31_3ds.c             |    5 ++-
> >  arch/arm/mach-imx/mach-mx31moboard.c          |    6 ++--
> >  arch/arm/mach-imx/mach-mx35_3ds.c             |    5 ++-
> >  arch/arm/mach-imx/mach-pcm037.c               |    5 ++-
> >  5 files changed, 23 insertions(+), 41 deletions(-)
> > 
> > diff --git a/arch/arm/mach-imx/devices/platform-ipu-core.c b/arch/arm/mach-imx/devices/platform-ipu-core.c
> > index 6bd7c3f..13ea542 100644
> > --- a/arch/arm/mach-imx/devices/platform-ipu-core.c
> > +++ b/arch/arm/mach-imx/devices/platform-ipu-core.c
> > @@ -69,42 +69,29 @@ struct platform_device *__init imx_alloc_mx3_camera(
> IMHO you should better rename the function because now it doesn't only
> allocate the device, but also registers it.

Agreed.

> 
> Also I doubt that it's OK to call dma_declare_coherent_memory after the
> device is added. In this case maybe extend
> platform_device_register_full? And also add a warning to
> dma_declare_coherent_memory if it is called for an already added device?
> (Added a few people to Cc: that might be able to comment this. I don't
> even know if there is a reliable way to check if a device is already
> added.)

Yes I also had doubts about that. However, apart from this patch there are
three other places in arch/arm/mach-imx/ where dma_declare_coherent_memory()
is called after calling platform_device_register_full().

Perhaps this is enough reason to extend platform_device_register_full().

It would be great to get some more feedback on this and also if there is a
reliable way to check if a device is already added.

Best regards,

Emil Goode

[PATCH 2/2] ARM: imx: convert camera init to use platform_device_register_full()

[Emil Goode]

Hello Uwe,

On Mon, May 19, 2014 at 08:27:22AM +0200, Uwe Kleine-K?nig wrote:
> Hello Emil,
> 
> thanks for your effort.
> 
> On Sun, May 18, 2014 at 10:51:00PM +0200, Emil Goode wrote:
> > This converts the imx camera allocation and initialization functions
> > to use platform_device_register_full() thus simplifying the code.
> > 
> > Signed-off-by: Emil Goode <emilgoode@gmail.com>
> > ---
> > Only build tested, unfortunately I currently don't have the hardware.
> > 
> >  arch/arm/mach-imx/devices/platform-ipu-core.c |   43 +++++++++----------------
> >  arch/arm/mach-imx/mach-mx31_3ds.c             |    5 ++-
> >  arch/arm/mach-imx/mach-mx31moboard.c          |    6 ++--
> >  arch/arm/mach-imx/mach-mx35_3ds.c             |    5 ++-
> >  arch/arm/mach-imx/mach-pcm037.c               |    5 ++-
> >  5 files changed, 23 insertions(+), 41 deletions(-)
> > 
> > diff --git a/arch/arm/mach-imx/devices/platform-ipu-core.c b/arch/arm/mach-imx/devices/platform-ipu-core.c
> > index 6bd7c3f..13ea542 100644
> > --- a/arch/arm/mach-imx/devices/platform-ipu-core.c
> > +++ b/arch/arm/mach-imx/devices/platform-ipu-core.c
> > @@ -69,42 +69,29 @@ struct platform_device *__init imx_alloc_mx3_camera(
> IMHO you should better rename the function because now it doesn't only
> allocate the device, but also registers it.
> 
> Also I doubt that it's OK to call dma_declare_coherent_memory after the
> device is added. In this case maybe extend
> platform_device_register_full? And also add a warning to
> dma_declare_coherent_memory if it is called for an already added device?
> (Added a few people to Cc: that might be able to comment this. I don't
> even know if there is a reliable way to check if a device is already
> added.)

According to the documentation dma_declare_coherent_memory() is only used
in unlikely corner cases, so I concluded that it is probably better not to
include it in platform_device_register_full().

Best regards,

Emil Goode