Messages in this thread | | | Subject | Re: [PATCH 1/3] mmc: sdhci-s3c: fix possible NULL pointer dereference when probed via platform | From | Sylwester Nawrocki <> | Date | Wed, 14 Apr 2021 18:49:41 +0200 |
| |
On 14.04.2021 17:25, Krzysztof Kozlowski wrote: > On 14/04/2021 17:12, Krzysztof Kozlowski wrote: >> The driver can be matched by legacy platform way or OF-device matching. >> In the first case, of_match_node() can return NULL, which immediately >> would be dereferenced to get the match data. >> >> Addresses-Coverity: Dereference null return value >> Fixes: cd1b00eb24b0 ("mmc: sdhci-s3c: Add device tree support") >> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
>> -#ifdef CONFIG_OF >> -static const struct of_device_id sdhci_s3c_dt_match[]; >> -#endif >> - >> static inline struct sdhci_s3c_drv_data *sdhci_s3c_get_driver_data( >> struct platform_device *pdev) >> { >> #ifdef CONFIG_OF >> - if (pdev->dev.of_node) { >> - const struct of_device_id *match; >> - match = of_match_node(sdhci_s3c_dt_match, pdev->dev.of_node); > > Now I have second thoughts whether NULL pointer can actually happen. If > device is matched via platform/board files, maybe the pdev->dev.of_node > will be NULL thus skipping this branch? > > Could there be a case where device is matched via platform_device_id() > (which has different name than compatible!) and (pdev->dev.of_node) is > still assigned? Maybe in case of out of tree DTS?
That seems unlikely, the platform device would need to be initialized via board file and then its of_node assigned somehow. It doesn't make much sense to me. We either use board file or dtb to instantiate devices.
> Anyway, the patch makes the code simpler/smaller, so I still think it is > reasonable. Just the severity of issue is questionable...
Yes, the patch looks good. Similar cleanups are already done in most of the s3c/s5p/exynos drivers.
-- Thanks, Sylwester
| |