* [PATCH v2 next] media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
@ 2024-10-17 20:34 Dan Carpenter
2024-10-18 1:18 ` [EXT] " Ming Qian
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2024-10-17 20:34 UTC (permalink / raw)
To: Ming Qian
Cc: Mirela Rabulea, Mauro Carvalho Chehab, Shawn Guo, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Hans Verkuil, TaoJiang,
imx, linux-media, linux-arm-kernel, linux-kernel, kernel-janitors
The proble is on the first line:
if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))
If jpeg->pd_dev[i] is an error pointer, then passing it to
pm_runtime_suspended() will lead to an Oops. The other conditions
check for both error pointers and NULL, but it would be more clear to
use the IS_ERR_OR_NULL() check for that.
Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended before detach them")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
v2: The buggy patch hasn't hit Linus's tree yet, but it's destined for stable so
add a stable tag to this too.
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
index d8e946aebba2..918ab12edc9e 100644
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -2679,11 +2679,12 @@ static void mxc_jpeg_detach_pm_domains(struct mxc_jpeg_dev *jpeg)
int i;
for (i = 0; i < jpeg->num_domains; i++) {
- if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))
+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) &&
+ !pm_runtime_suspended(jpeg->pd_dev[i]))
pm_runtime_force_suspend(jpeg->pd_dev[i]);
- if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i]))
+ if (!IS_ERR_OR_NULL(jpeg->pd_link[i]))
device_link_del(jpeg->pd_link[i]);
- if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i]))
+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]))
dev_pm_domain_detach(jpeg->pd_dev[i], true);
jpeg->pd_dev[i] = NULL;
jpeg->pd_link[i] = NULL;
--
2.45.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* RE: [EXT] [PATCH v2 next] media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
2024-10-17 20:34 [PATCH v2 next] media: imx-jpeg: Fix potential error pointer dereference in detach_pm() Dan Carpenter
@ 2024-10-18 1:18 ` Ming Qian
0 siblings, 0 replies; 2+ messages in thread
From: Ming Qian @ 2024-10-18 1:18 UTC (permalink / raw)
To: Dan Carpenter
Cc: Mirela Rabulea, Mauro Carvalho Chehab, Shawn Guo, Sascha Hauer,
Pengutronix Kernel Team, Fabio Estevam, Hans Verkuil, Tao Jiang,
imx@lists.linux.dev, linux-media@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
>The proble is on the first line:
>
> if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))
>
>If jpeg->pd_dev[i] is an error pointer, then passing it to
>pm_runtime_suspended() will lead to an Oops. The other conditions check for
>both error pointers and NULL, but it would be more clear to use the
>IS_ERR_OR_NULL() check for that.
>
>Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended
>before detach them")
>Cc: <stable@vger.kernel.org>
>Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Ming Qian <ming.qian@nxp.com>
>---
>v2: The buggy patch hasn't hit Linus's tree yet, but it's destined for stable so
> add a stable tag to this too.
>
> drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>index d8e946aebba2..918ab12edc9e 100644
>--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
>@@ -2679,11 +2679,12 @@ static void mxc_jpeg_detach_pm_domains(struct
>mxc_jpeg_dev *jpeg)
> int i;
>
> for (i = 0; i < jpeg->num_domains; i++) {
>- if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))
>+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) &&
>+ !pm_runtime_suspended(jpeg->pd_dev[i]))
> pm_runtime_force_suspend(jpeg->pd_dev[i]);
>- if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i]))
>+ if (!IS_ERR_OR_NULL(jpeg->pd_link[i]))
> device_link_del(jpeg->pd_link[i]);
>- if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i]))
>+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]))
> dev_pm_domain_detach(jpeg->pd_dev[i], true);
> jpeg->pd_dev[i] = NULL;
> jpeg->pd_link[i] = NULL;
>--
>2.45.2
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-10-18 1:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-17 20:34 [PATCH v2 next] media: imx-jpeg: Fix potential error pointer dereference in detach_pm() Dan Carpenter
2024-10-18 1:18 ` [EXT] " Ming Qian
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).