lkml.org 
[lkml]   [2018]   [Apr]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: media: rcar-vin: add group allocator functions
Hi Colin,

Thanks for reporting this. I wonder why smatch and sparse did not catch
this, the fault can't be mine for writing such a obviously bad thing
right :-)

I have a patch to address this, just need to test it before posting.

On 2018-04-24 14:14:02 +0100, Colin Ian King wrote:
> Hi there,
>
> While running static analysis on linux-next today a null pointer
> dereference issue was detected by CoverityScan. The following commit
> introduced the issue:
>
> commit 3bb4c3bc85bf77a76c921671800bde2e1bf82a88
> Author: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
> Date: Sat Apr 14 07:57:18 2018 -0400
>
> media: rcar-vin: add group allocator functions
>
> The analysis is as follows:
>
> 339 static void rvin_group_put(struct rvin_dev *vin)
> 340 {
> 341 mutex_lock(&vin->group->lock);
> 342
> 1. assign_zero: Assigning: vin->group = NULL.
>
> 343 vin->group = NULL;
> 344 vin->v4l2_dev.mdev = NULL;
> 345
> CID 1468359 (#1 of 1): Explicit null dereferenced (FORWARD_NULL)
> 2. var_deref_op: Dereferencing null pointer vin->group.
>
> 346 if (WARN_ON(vin->group->vin[vin->id] != vin))
> 347 goto out;
> 348
>
> vin->group is NULL however the WARN_ON is dereferencing it, causing an
> OOPS. I don't know how this should be fixed, hence I am sending this
> bug report.
>
> Regards,
>
> Colin

--
Regards,
Niklas Söderlund

\
 
 \ /
  Last update: 2018-04-25 00:36    [W:0.150 / U:0.092 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site