[patch] video/saa7134: potential null dereferences in debug code

[patch] video/saa7134: potential null dereferences in debug code

[Dan Carpenter]

I modified the dprintk and i2cdprintk macros to handle null dev and ir
pointers.  There are two couple places that call dprintk() when "dev" is
null.  One is in get_key_msi_tvanywhere_plus() and the other is in
get_key_flydvb_trio(). 

Signed-off-by: Dan Carpenter <error27@gmail.com>

diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index e5565e2..e14f2f8 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
     "alternative remotes from other manufacturers");
 
 #define dprintk(fmt, arg...)	if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
 #define i2cdprintk(fmt, arg...)    if (ir_debug) \
-	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
+	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
 
 /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
 static int saa7134_rc5_irq(struct saa7134_dev *dev);

Re: [patch] video/saa7134: potential null dereferences in debug code

[Jean Delvare]

Hi Dan,

On Sat, 22 May 2010 22:15:35 +0200, Dan Carpenter wrote:
> I modified the dprintk and i2cdprintk macros to handle null dev and ir
> pointers.  There are two couple places that call dprintk() when "dev" is
> null.  One is in get_key_msi_tvanywhere_plus() and the other is in
> get_key_flydvb_trio(). 
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> 
> diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
> index e5565e2..e14f2f8 100644
> --- a/drivers/media/video/saa7134/saa7134-input.c
> +++ b/drivers/media/video/saa7134/saa7134-input.c
> @@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
>      "alternative remotes from other manufacturers");
>  
>  #define dprintk(fmt, arg...)	if (ir_debug) \
> -	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
> +	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
>  #define i2cdprintk(fmt, arg...)    if (ir_debug) \
> -	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
> +	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
>  
>  /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
>  static int saa7134_rc5_irq(struct saa7134_dev *dev);

I would have used "(null)" instead of "<null>" for consistency with
lib/vsprintf.c:string().

But more importantly, I suspect that a better fix would be to not call
these macros when dev or ir, respectively, is NULL. The faulty dprintk
calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could
be replaced with i2cdprintk (which is misnamed IMHO, BTW.)

-- 
Jean Delvare

[patch v2] video/saa7134: change dprintk() to i2cdprintk()

[Dan Carpenter]

The problem is that dprintk() dereferences "dev" which is null here.
The i2cdprintk() uses "ir" so that's OK.

Also removed a duplicated break statement.

Signed-off-by: Dan Carpenter <error27@gmail.com>
---
v2: Jean Delvare suggested that I use i2cdprintk() instead of modifying
dprintk().

diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index e5565e2..7691bf2 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -141,8 +141,8 @@ static int get_key_flydvb_trio(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
 	struct saa7134_dev *dev = ir->c->adapter->algo_data;
 
 	if (dev == NULL) {
-		dprintk("get_key_flydvb_trio: "
-			 "gir->c->adapter->algo_data is NULL!\n");
+		i2cdprintk("get_key_flydvb_trio: "
+			   "gir->c->adapter->algo_data is NULL!\n");
 		return -EIO;
 	}
 
@@ -195,8 +195,8 @@ static int get_key_msi_tvanywhere_plus(struct IR_i2c *ir, u32 *ir_key,
 	/* <dev> is needed to access GPIO. Used by the saa_readl macro. */
 	struct saa7134_dev *dev = ir->c->adapter->algo_data;
 	if (dev == NULL) {
-		dprintk("get_key_msi_tvanywhere_plus: "
-			"gir->c->adapter->algo_data is NULL!\n");
+		i2cdprintk("get_key_msi_tvanywhere_plus: "
+			   "gir->c->adapter->algo_data is NULL!\n");
 		return -EIO;
 	}
 
@@ -815,7 +815,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
 		mask_keyup   = 0x020000;
 		polling      = 50; /* ms */
 		break;
-	break;
 	}
 	if (NULL == ir_codes) {
 		printk("%s: Oops: IR config error [card=%d]\n",

Re: [patch v2] video/saa7134: change dprintk() to i2cdprintk()

[Jean Delvare]

Hi Dan,

On Mon, 24 May 2010 17:59:36 +0200, Dan Carpenter wrote:
> The problem is that dprintk() dereferences "dev" which is null here.
> The i2cdprintk() uses "ir" so that's OK.
> 
> Also removed a duplicated break statement.

Mixing two unrelated fixes in the same patch is a bad idea. Here, the
replacement of dprintk() with i2cdprintk() fixes a potential NULL
pointer dereference, this might be worth backporting to stable kernel
series. The double break, OTOH, can't cause any harm, it's a simple
clean-up. So separate patches would be preferable.

> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> v2: Jean Delvare suggested that I use i2cdprintk() instead of modifying
> dprintk().
> 
> diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
> index e5565e2..7691bf2 100644
> --- a/drivers/media/video/saa7134/saa7134-input.c
> +++ b/drivers/media/video/saa7134/saa7134-input.c
> @@ -141,8 +141,8 @@ static int get_key_flydvb_trio(struct IR_i2c *ir, u32 *ir_key, u32 *ir_raw)
>  	struct saa7134_dev *dev = ir->c->adapter->algo_data;
>  
>  	if (dev == NULL) {
> -		dprintk("get_key_flydvb_trio: "
> -			 "gir->c->adapter->algo_data is NULL!\n");
> +		i2cdprintk("get_key_flydvb_trio: "
> +			   "gir->c->adapter->algo_data is NULL!\n");
>  		return -EIO;
>  	}
>  
> @@ -195,8 +195,8 @@ static int get_key_msi_tvanywhere_plus(struct IR_i2c *ir, u32 *ir_key,
>  	/* <dev> is needed to access GPIO. Used by the saa_readl macro. */
>  	struct saa7134_dev *dev = ir->c->adapter->algo_data;
>  	if (dev == NULL) {
> -		dprintk("get_key_msi_tvanywhere_plus: "
> -			"gir->c->adapter->algo_data is NULL!\n");
> +		i2cdprintk("get_key_msi_tvanywhere_plus: "
> +			   "gir->c->adapter->algo_data is NULL!\n");
>  		return -EIO;
>  	}
>  
> @@ -815,7 +815,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
>  		mask_keyup   = 0x020000;
>  		polling      = 50; /* ms */
>  		break;
> -	break;
>  	}
>  	if (NULL == ir_codes) {
>  		printk("%s: Oops: IR config error [card=%d]\n",

Acked-by: Jean Delvare <khali@linux-fr.org>

-- 
Jean Delvare

Re: [patch] video/saa7134: potential null dereferences in debug code

[Mauro Carvalho Chehab]

Em Sat, 22 May 2010 22:59:21 +0200
Jean Delvare <khali@linux-fr.org> escreveu:

> Hi Dan,
> 
> On Sat, 22 May 2010 22:15:35 +0200, Dan Carpenter wrote:
> > I modified the dprintk and i2cdprintk macros to handle null dev and ir
> > pointers.  There are two couple places that call dprintk() when "dev" is
> > null.  One is in get_key_msi_tvanywhere_plus() and the other is in
> > get_key_flydvb_trio(). 
> > 
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
> > 
> > diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
> > index e5565e2..e14f2f8 100644
> > --- a/drivers/media/video/saa7134/saa7134-input.c
> > +++ b/drivers/media/video/saa7134/saa7134-input.c
> > @@ -61,9 +61,9 @@ MODULE_PARM_DESC(disable_other_ir, "disable full codes of "
> >      "alternative remotes from other manufacturers");
> >  
> >  #define dprintk(fmt, arg...)	if (ir_debug) \
> > -	printk(KERN_DEBUG "%s/ir: " fmt, dev->name , ## arg)
> > +	printk(KERN_DEBUG "%s/ir: " fmt, dev ? dev->name : "<null>", ## arg)
> >  #define i2cdprintk(fmt, arg...)    if (ir_debug) \
> > -	printk(KERN_DEBUG "%s/ir: " fmt, ir->name , ## arg)
> > +	printk(KERN_DEBUG "%s/ir: " fmt, ir ? ir->name : "<null>", ## arg)
> >  
> >  /* Helper functions for RC5 and NEC decoding at GPIO16 or GPIO18 */
> >  static int saa7134_rc5_irq(struct saa7134_dev *dev);
> 
> I would have used "(null)" instead of "<null>" for consistency with
> lib/vsprintf.c:string().
> 
> But more importantly, I suspect that a better fix would be to not call
> these macros when dev or ir, respectively, is NULL. The faulty dprintk
> calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could
> be replaced with i2cdprintk (which is misnamed IMHO, BTW.)

Agreed.

Dan, could you please rework your patch according with Jean's feedback?

Thanks,
Mauro
-- 

Cheers,
Mauro

Re: [patch] video/saa7134: potential null dereferences in debug code

[Jean Delvare]

On Sat, 29 May 2010 01:29:54 -0300, Mauro Carvalho Chehab wrote:
> Em Sat, 22 May 2010 22:59:21 +0200
> Jean Delvare <khali@linux-fr.org> escreveu:
> > I would have used "(null)" instead of "<null>" for consistency with
> > lib/vsprintf.c:string().
> > 
> > But more importantly, I suspect that a better fix would be to not call
> > these macros when dev or ir, respectively, is NULL. The faulty dprintk
> > calls in get_key_msi_tvanywhere_plus() and get_key_flydvb_trio() could
> > be replaced with i2cdprintk (which is misnamed IMHO, BTW.)
> 
> Agreed.
> 
> Dan, could you please rework your patch according with Jean's feedback?

He did already.

-- 
Jean Delvare