From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-co1nam03on0092.outbound.protection.outlook.com ([104.47.40.92]:45512 "EHLO NAM03-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S966089AbeCHFEB (ORCPT ); Thu, 8 Mar 2018 00:04:01 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: "Gustavo A. R. Silva" , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH AUTOSEL for 4.9 154/190] media: c8sectpfe: fix potential NULL pointer dereference in c8sectpfe_timer_interrupt Date: Thu, 8 Mar 2018 05:00:00 +0000 Message-ID: <20180308045810.8041-154-alexander.levin@microsoft.com> References: <20180308045810.8041-1-alexander.levin@microsoft.com> In-Reply-To: <20180308045810.8041-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: "Gustavo A. R. Silva" [ Upstream commit baed3c4bc4c13de93e0dba0a26d601411ebcb389 ] _channel_ is being dereferenced before it is null checked, hence there is a potential null pointer dereference. Fix this by moving the pointer derefere= nce after _channel_ has been null checked. This issue was detected with the help of Coccinelle. Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support= ") Signed-off-by: Gustavo A. R. Silva Acked-by: Patrice Chotard Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/driver= s/media/platform/sti/c8sectpfe/c8sectpfe-core.c index 30c148b9d65e..06e2cfd09855 100644 --- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c @@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8se= ctpfei) static void channel_swdemux_tsklet(unsigned long data) { struct channel_info *channel =3D (struct channel_info *)data; - struct c8sectpfei *fei =3D channel->fei; + struct c8sectpfei *fei; unsigned long wp, rp; int pos, num_packets, n, size; u8 *buf; @@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data) if (unlikely(!channel || !channel->irec)) return; =20 + fei =3D channel->fei; + wp =3D readl(channel->irec + DMA_PRDS_BUSWP_TP(0)); rp =3D readl(channel->irec + DMA_PRDS_BUSRP_TP(0)); =20 --=20 2.14.1