[PATCH] PPC: CHRP - fix possible NULL pointer dereference

[PATCH] PPC: CHRP - fix possible NULL pointer dereference

[Cyrill Gorcunov]

From: Cyrill Gorcunov <gorcunov@gmail.com>

This patch does fix possible NULL pointer dereference
inside of strncmp() if of_get_property() failed.

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---

 arch/powerpc/platforms/chrp/setup.c |   23 +++++++++++++----------
 1 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index 5930626..e3f276d 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -115,7 +115,7 @@ void chrp_show_cpuinfo(struct seq_file *m)
 	seq_printf(m, "machine\t\t: CHRP %s\n", model);
 
 	/* longtrail (goldengate) stuff */
-	if (!strncmp(model, "IBM,LongTrail", 13)) {
+	if (model && !strncmp(model, "IBM,LongTrail", 13)) {
 		/* VLSI VAS96011/12 `Golden Gate 2' */
 		/* Memory banks */
 		sdramen = (in_le32(gg2_pci_config_base + GG2_PCI_DRAM_CTRL)
@@ -203,16 +203,19 @@ static void __init sio_fixup_irq(const char *name, u8 device, u8 level,
 static void __init sio_init(void)
 {
 	struct device_node *root;
+	const char *model = NULL;
 
-	if ((root = of_find_node_by_path("/")) &&
-	    !strncmp(of_get_property(root, "model", NULL),
-			"IBM,LongTrail", 13)) {
-		/* logical device 0 (KBC/Keyboard) */
-		sio_fixup_irq("keyboard", 0, 1, 2);
-		/* select logical device 1 (KBC/Mouse) */
-		sio_fixup_irq("mouse", 1, 12, 2);
-	}
-	of_node_put(root);
+	root = of_find_node_by_path("/");
+	if (root) {
+		model = of_get_property(root, "model", NULL);
+		if (model && !strncmp(model,"IBM,LongTrail", 13)) {
+			/* logical device 0 (KBC/Keyboard) */
+			sio_fixup_irq("keyboard", 0, 1, 2);
+			/* select logical device 1 (KBC/Mouse) */
+			sio_fixup_irq("mouse", 1, 12, 2);
+		}
+		of_node_put(root);
+ 	}
 }
 
 

Re: [PATCH] PPC: CHRP - fix possible NULL pointer dereference

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 658 bytes --]

On Thu, 22 Nov 2007 22:54:23 +0300 Cyrill Gorcunov <gorcunov@gmail.com> wrote:
>
> This patch does fix possible NULL pointer dereference
> inside of strncmp() if of_get_property() failed.

Thanks for this.

>  static void __init sio_init(void)
>  {
>  	struct device_node *root;
> +	const char *model = NULL;

You don't need this initialization as you always assign the variable
before you use it.

> +	root = of_find_node_by_path("/");
> +	if (root) {

	if (!root)
		return;

would save a level of indentation. Not important.

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au
http://www.canb.auug.org.au/~sfr/

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [PATCH] PPC: CHRP - fix possible NULL pointer dereference

[Cyrill Gorcunov]

On 11/23/07, Stephen Rothwell <sfr@canb.auug.org.au> wrote:
> On Thu, 22 Nov 2007 22:54:23 +0300 Cyrill Gorcunov <gorcunov@gmail.com>
> wrote:
> >
> > This patch does fix possible NULL pointer dereference
> > inside of strncmp() if of_get_property() failed.
>
> Thanks for this.
>
> >  static void __init sio_init(void)
> >  {
> >   struct device_node *root;
> > + const char *model = NULL;
>
> You don't need this initialization as you always assign the variable
> before you use it.
>
> > + root = of_find_node_by_path("/");
> > + if (root) {
>
>  if (!root)
>   return;
>
> would save a level of indentation. Not important.
>
> --
> Cheers,
> Stephen Rothwell                    sfr@canb.auug.org.au
> http://www.canb.auug.org.au/~sfr/
>
Oh my :) Thanks. I'll fix it and resend.

Re: [PATCH] PPC: CHRP - fix possible NULL pointer dereference

[Cyrill Gorcunov]

[-- Attachment #1: Type: text/plain, Size: 232 bytes --]

Here is updated version
---
From: Cyrill Gorcunov <gorcunov@gmail.com>

This patch does fix possible NULL pointer dereference
inside of strncmp() if of_get_property() failed.

Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---

[-- Attachment #2: ppc-chrs-null-fix.diff --]
[-- Type: text/plain, Size: 1356 bytes --]

 arch/powerpc/platforms/chrp/setup.c |   13 +++++++++----
 1 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index 5930626..da4e45e 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -115,7 +115,7 @@ void chrp_show_cpuinfo(struct seq_file *m)
 	seq_printf(m, "machine\t\t: CHRP %s\n", model);
 
 	/* longtrail (goldengate) stuff */
-	if (!strncmp(model, "IBM,LongTrail", 13)) {
+	if (model && !strncmp(model, "IBM,LongTrail", 13)) {
 		/* VLSI VAS96011/12 `Golden Gate 2' */
 		/* Memory banks */
 		sdramen = (in_le32(gg2_pci_config_base + GG2_PCI_DRAM_CTRL)
@@ -203,15 +203,20 @@ static void __init sio_fixup_irq(const char *name, u8 device, u8 level,
 static void __init sio_init(void)
 {
 	struct device_node *root;
+	const char *model;
 
-	if ((root = of_find_node_by_path("/")) &&
-	    !strncmp(of_get_property(root, "model", NULL),
-			"IBM,LongTrail", 13)) {
+	root = of_find_node_by_path("/");
+	if (!root)
+		return;
+
+	model = of_get_property(root, "model", NULL);
+	if (model && !strncmp(model,"IBM,LongTrail", 13)) {
 		/* logical device 0 (KBC/Keyboard) */
 		sio_fixup_irq("keyboard", 0, 1, 2);
 		/* select logical device 1 (KBC/Mouse) */
 		sio_fixup_irq("mouse", 1, 12, 2);
 	}
+
 	of_node_put(root);
 }