| Message ID | ZxF0yOCms6cldOlV@stanley.mountain |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2,next] media: imx-jpeg: Fix potential error pointer dereference in detach_pm() | expand |
>The proble is on the first line: > > if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) > >If jpeg->pd_dev[i] is an error pointer, then passing it to >pm_runtime_suspended() will lead to an Oops. The other conditions check for >both error pointers and NULL, but it would be more clear to use the >IS_ERR_OR_NULL() check for that. > >Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended >before detach them") >Cc: <stable@vger.kernel.org> >Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Ming Qian <ming.qian@nxp.com> >--- >v2: The buggy patch hasn't hit Linus's tree yet, but it's destined for stable so > add a stable tag to this too. > > drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > >diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c >b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c >index d8e946aebba2..918ab12edc9e 100644 >--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c >+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c >@@ -2679,11 +2679,12 @@ static void mxc_jpeg_detach_pm_domains(struct >mxc_jpeg_dev *jpeg) > int i; > > for (i = 0; i < jpeg->num_domains; i++) { >- if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) >+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) && >+ !pm_runtime_suspended(jpeg->pd_dev[i])) > pm_runtime_force_suspend(jpeg->pd_dev[i]); >- if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i])) >+ if (!IS_ERR_OR_NULL(jpeg->pd_link[i])) > device_link_del(jpeg->pd_link[i]); >- if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i])) >+ if (!IS_ERR_OR_NULL(jpeg->pd_dev[i])) > dev_pm_domain_detach(jpeg->pd_dev[i], true); > jpeg->pd_dev[i] = NULL; > jpeg->pd_link[i] = NULL; >-- >2.45.2
diff --git a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c index d8e946aebba2..918ab12edc9e 100644 --- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c +++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c @@ -2679,11 +2679,12 @@ static void mxc_jpeg_detach_pm_domains(struct mxc_jpeg_dev *jpeg) int i; for (i = 0; i < jpeg->num_domains; i++) { - if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) + if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) && + !pm_runtime_suspended(jpeg->pd_dev[i])) pm_runtime_force_suspend(jpeg->pd_dev[i]); - if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i])) + if (!IS_ERR_OR_NULL(jpeg->pd_link[i])) device_link_del(jpeg->pd_link[i]); - if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i])) + if (!IS_ERR_OR_NULL(jpeg->pd_dev[i])) dev_pm_domain_detach(jpeg->pd_dev[i], true); jpeg->pd_dev[i] = NULL; jpeg->pd_link[i] = NULL;
The proble is on the first line: if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) If jpeg->pd_dev[i] is an error pointer, then passing it to pm_runtime_suspended() will lead to an Oops. The other conditions check for both error pointers and NULL, but it would be more clear to use the IS_ERR_OR_NULL() check for that. Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended before detach them") Cc: <stable@vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- v2: The buggy patch hasn't hit Linus's tree yet, but it's destined for stable so add a stable tag to this too. drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)