media: s5p-mfc: fix incorrect bus assignment in virtual child device

Message ID 20190107120414.30622-1-m.szyprowski@samsung.com
State New
Headers show
Series
  • media: s5p-mfc: fix incorrect bus assignment in virtual child device
Related show

Commit Message

Marek Szyprowski Jan. 7, 2019, 12:04 p.m.
Virtual MFC codec's child devices must not be assigned to platform bus,
because they are allocated as raw 'struct device' and don't have the
corresponding 'platform' part. This fixes NULL pointer access revealed
recently by commit a66d972465d1 ("devres: Align data[] to
ARCH_KMALLOC_MINALIGN").

Reported-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
Fixes: c79667dd93b0 ("media: s5p-mfc: replace custom reserved memory handling code with generic one")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>

---
 drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 -
 1 file changed, 1 deletion(-)

-- 
2.17.1

Comments

Paweł Chmiel Jan. 7, 2019, 3:29 p.m. | #1
Dnia poniedziałek, 7 stycznia 2019 13:04:14 CET Marek Szyprowski pisze:
> Virtual MFC codec's child devices must not be assigned to platform bus,

> because they are allocated as raw 'struct device' and don't have the

> corresponding 'platform' part. This fixes NULL pointer access revealed

> recently by commit a66d972465d1 ("devres: Align data[] to

> ARCH_KMALLOC_MINALIGN").

> 

> Reported-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

> Fixes: c79667dd93b0 ("media: s5p-mfc: replace custom reserved memory handling code with generic one")

> Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>

> ---

>  drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 -

>  1 file changed, 1 deletion(-)

> 

> diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c

> index 927a1235408d..ca11f8a7569d 100644

> --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c

> +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c

> @@ -1089,7 +1089,6 @@ static struct device *s5p_mfc_alloc_memdev(struct device *dev,

>  	device_initialize(child);

>  	dev_set_name(child, "%s:%s", dev_name(dev), name);

>  	child->parent = dev;

> -	child->bus = dev->bus;

>  	child->coherent_dma_mask = dev->coherent_dma_mask;

>  	child->dma_mask = dev->dma_mask;

>  	child->release = s5p_mfc_memdev_release;

> 


Checked on Samsung Galaxy S and not it's not crashing anymore. Thanks for patch.
Tested-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>

Patch

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 927a1235408d..ca11f8a7569d 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1089,7 +1089,6 @@  static struct device *s5p_mfc_alloc_memdev(struct device *dev,
 	device_initialize(child);
 	dev_set_name(child, "%s:%s", dev_name(dev), name);
 	child->parent = dev;
-	child->bus = dev->bus;
 	child->coherent_dma_mask = dev->coherent_dma_mask;
 	child->dma_mask = dev->dma_mask;
 	child->release = s5p_mfc_memdev_release;