[PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

[PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

[Roel Kluin]

Don't dereference autodep when it's NULL. In _autodep_lookup() an
ERR_PTR(-ENOENT) is assigned to autodep->pwrdm.ptr if pwrdm_lookup() fails.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
---

Alternatively we could do:

-		for (autodep = autodeps; autodep->pwrdm.ptr; autodep++)
+		for (autodep = autodeps; !IS_ERR(autodep->pwrdm.ptr); autodep++)

...but considering how _clkdm_add_autodeps() traverses trough the autodeps it
appears that we want to ignore failures. Correct?

Roel

diff --git a/arch/arm/mach-omap2/clockdomain.c b/arch/arm/mach-omap2/clockdomain.c
index dd285f0..8f359c1 100644
--- a/arch/arm/mach-omap2/clockdomain.c
+++ b/arch/arm/mach-omap2/clockdomain.c
@@ -64,9 +64,6 @@ static void _autodep_lookup(struct clkdm_pwrdm_autodep *autodep)
 {
 	struct powerdomain *pwrdm;
 
-	if (!autodep)
-		return;
-
 	if (!omap_chip_is(autodep->omap_chip))
 		return;
 
@@ -211,7 +208,7 @@ void clkdm_init(struct clockdomain **clkdms,
 
 	autodeps = init_autodeps;
 	if (autodeps)
-		for (autodep = autodeps; autodep->pwrdm.ptr; autodep++)
+		for (autodep = autodeps; autodep; autodep++)
 			_autodep_lookup(autodep);
 }
 

Re: [PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

[Roel Kluin]

Op 14-02-10 17:00, Roel Kluin schreef:
> Don't dereference autodep when it's NULL. In _autodep_lookup() an
> ERR_PTR(-ENOENT) is assigned to autodep->pwrdm.ptr if pwrdm_lookup() fails.

I am not sure whether my patch was right, if indeed a dereference, then it
appears to also occur in _clkdm_add_autodeps() and _clkdm_del_autodeps().

Roel

Re: [PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

[Paul Walmsley]

Hi Roel,

On Sun, 14 Feb 2010, Roel Kluin wrote:

> Don't dereference autodep when it's NULL. In _autodep_lookup() an
> ERR_PTR(-ENOENT) is assigned to autodep->pwrdm.ptr if pwrdm_lookup() fails.
> 
> Signed-off-by: Roel Kluin <roel.kluin@gmail.com>

Thanks for the patch, but I don't understand what problem you're
pointing out.  If autodeps is NULL entering clkdm_init(), then the
for-loop won't even be entered.

It looks like there may be a problem, however, in _clkdm_add_autodeps() 
and _clkdm_del_autodeps() if no autodeps were passed in.  What do you 
think about something like the following instead?


- Paul


From: Paul Walmsley <paul@pwsan.com>
Date: Mon, 22 Feb 2010 14:01:45 -0700
Subject: [PATCH] OMAP clockdomain: if no autodeps exist, don't try to add or remove them

_clkdm_add_autodeps() and _clkdm_del_autodeps() will attempt to dereference
a NULL pointer if no autodeps were supplied to clkdm_init().

Based on a patch from Roel Kluin <roel.kluin@gmail.com> - thanks Roel.

Signed-off-by: Paul Walmsley <paul@pwsan.com>
Cc: Roel Kluin <roel.kluin@gmail.com>
---
 arch/arm/mach-omap2/clockdomain.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/arch/arm/mach-omap2/clockdomain.c b/arch/arm/mach-omap2/clockdomain.c
index de4278c..b26d30a 100644
--- a/arch/arm/mach-omap2/clockdomain.c
+++ b/arch/arm/mach-omap2/clockdomain.c
@@ -173,6 +173,9 @@ static void _clkdm_add_autodeps(struct clockdomain *clkdm)
 {
 	struct clkdm_autodep *autodep;
 
+	if (!autodeps)
+		return;
+
 	for (autodep = autodeps; autodep->clkdm.ptr; autodep++) {
 		if (IS_ERR(autodep->clkdm.ptr))
 			continue;
@@ -201,6 +204,9 @@ static void _clkdm_del_autodeps(struct clockdomain *clkdm)
 {
 	struct clkdm_autodep *autodep;
 
+	if (!autodeps)
+		return;
+
 	for (autodep = autodeps; autodep->clkdm.ptr; autodep++) {
 		if (IS_ERR(autodep->clkdm.ptr))
 			continue;
-- 
1.6.6.GIT

Re: [PATCH] OMAP: Dereference of NULL autodep in _autodep_lookup()

[roel kluin]

> Thanks for the patch, but I don't understand what problem you're
> pointing out.  If autodeps is NULL entering clkdm_init(), then the
> for-loop won't even be entered.

My first patch was wrong, but there's something I think could
be wrong. In clkdm_init() we have:

for (autodep = autodeps; autodep->pwrdm.ptr; autodep++)
        _autodep_lookup(autodep);

In _autodep_lookup() we ensure that we don't dereference
autodep by:

if (!autodep)
        return;

but if autodep can be NULL we already dereferenced it in
the aforementioned for loop, so shouldn't that be:

for (autodep = autodeps; autodep && autodep->pwrdm.ptr; autodep++)
        _autodep_lookup(autodep);

Then since this is the only call to _autodep_lookup() we can remove
that test there. Do you agree?

> It looks like there may be a problem, however, in _clkdm_add_autodeps()
> and _clkdm_del_autodeps() if no autodeps were passed in.  What do you
> think about something like the following instead?
>
>
> - Paul

Your suggested patch looks right to me as well.