Patch to solve NULL pointer dereference in physmap_of.c
Prins Anton (ST-CO/ENG1.1)
Anton.Prins at nl.bosch.com
Wed Dec 5 09:19:45 EST 2012
Hi Artem,
Sorry I'm in a learning curve... now used 'git format-patch'.
This made it working for 'git am'; so hopefully this time its fine!
Artem, thanks for your support!
Met vriendelijke groeten | Best Regards,
Anton Prins
>From 1f7a524dfd9b0c4b315651ebdab87938430048a9 Mon Sep 17 00:00:00 2001
From: Anton Prins <anton.prins at nl.bosch.com>
Date: Tue, 27 Nov 2012 16:38:16 +0100
Subject: [PATCH] mtd: maps/physmap_of.c: error checking to prevent a NULL pointer dereference
This patch solves a NULL pointer dereference, this may occur if the tuple
is not mappable (jumps to continue in the for-loop). Out of the loop
possible results are:
- info->list_size == 0 if no of the tuples is mappable
- info->list_size == 1
- info->list_size > 1
If no one of the supplied tuples is mappable (info->list_size == 0) and
info->cmtd will not be set. But it is used in mtd_device_parse_register, OOPS!
actually it should generate an error in this case!
---
drivers/mtd/maps/physmap_of.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
index 2e6fb68..f6de444 100644
--- a/drivers/mtd/maps/physmap_of.c
+++ b/drivers/mtd/maps/physmap_of.c
@@ -268,6 +268,7 @@ static int __devinit of_flash_probe(struct platform_device *dev)
}
err = 0;
+ info->cmtd = NULL;
if (info->list_size == 1) {
info->cmtd = info->list[0].mtd;
} else if (info->list_size > 1) {
@@ -276,9 +277,10 @@ static int __devinit of_flash_probe(struct platform_device *dev)
*/
info->cmtd = mtd_concat_create(mtd_list, info->list_size,
dev_name(&dev->dev));
- if (info->cmtd == NULL)
- err = -ENXIO;
}
+ if (info->cmtd == NULL)
+ err = -ENXIO;
+
if (err)
goto err_out;
--
1.7.0.4
Met vriendelijke groeten | Best Regards,
Anton Prins
Bosch Security Systems BV,
Conference Systems (ST-CO/ENG1.1)
Torenallee 49
5617 BA Eindhoven
The Netherlands
www.boschsecurity.com
T. +31 (0)40 2577077
anton.prins at nl.bosch.com
-----Original Message-----
From: Artem Bityutskiy [mailto:dedekind1 at gmail.com]
Sent: vrijdag 30 november 2012 12:51
To: Prins Anton (ST-CO/ENG1.1)
Cc: linux-mtd at lists.infradead.org
Subject: Re: Patch to solve NULL pointer dereference in physmap_of.c
Hi, sorry for long delay, but would you please re-send this in a nice
form:
1. Wrap commit message lines to 80 characters.
2. Make the patch applicable with 'git am' - this one does not apply.
Thanks!
On Thu, 2012-11-22 at 16:20 +0100, Prins Anton (ST-CO/ENG1.1) wrote:
> [PATCH] mtd: maps/physmap_of.c: change error checking to prevent a NULL pointer dereference if no DTS tuple is mappable
>
> This patch solves a NULL pointer dereference, this may occur if the tuple is not mappable (jumps to continue in the for-loop).
> Out of the loop possible results are:
> - info->list_size == 0 if no of the tuples is mappable
> - info->list_size == 1
> - info->list_size > 1
> If no one of the supplied tuples is mappable (info->list_size == 0) and info->cmtd will not be set.
> But it is used in mtd_device_parse_register, OOPS... if should generate an error in this case!
>
> [From: Anton Prins <anton.prins at nl.bosch.com>]
>
> diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
> index 2e6fb68..f6de444 100644
> --- a/drivers/mtd/maps/physmap_of.c
> +++ b/drivers/mtd/maps/physmap_of.c
> @@ -268,6 +268,7 @@ static int __devinit of_flash_probe(struct platform_device *dev)
> }
>
> err = 0;
> + info->cmtd = NULL;
> if (info->list_size == 1) {
> info->cmtd = info->list[0].mtd;
> } else if (info->list_size > 1) {
> @@ -276,9 +277,10 @@ static int __devinit of_flash_probe(struct platform_device *dev)
> */
> info->cmtd = mtd_concat_create(mtd_list, info->list_size,
> dev_name(&dev->dev));
- if (info->cmtd == NULL)
> - err = -ENXIO;
> }
> + if (info->cmtd == NULL)
> + err = -ENXIO;
> +
> if (err)
> goto err_out;
>
> -----Original Message-----
> From: Artem Bityutskiy [mailto:dedekind1 at gmail.com]
> Sent: woensdag 21 november 2012 8:42
> To: Prins Anton (ST-CO/ENG1.1)
> Cc: linux-mtd at lists.infradead.org
> Subject: Re: Patch to solve NULL pointer dereference in physmap_of.c
> On Fri, 2012-11-09 at 08:45 +0100, Prins Anton (ST-CO/ENG1.1) wrote:
> commit 0905a6f4aec377123e94d2260f2f7a0d867e19be
> > Author: Anton Prins <anton.prins at nl.bosch.com>
> > Date: Fri Nov 9 10:12:58 2012 +0100
> >
> > Correct error checking to prevent a NULL pointer dereference
> >
> > The problem only occurs if the DTS is not correct, the requested mapping is not reserved on the parent bus.
> > In this special case the count is 1, but the list_size after mapping is 0. list_size 0 should generate an error!
>
> Sorry, I do not really understand which problem this patch solves, could
> you please improve the commit message and re-send?
>
> >
> > diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
> > index 2e6fb68..83d121e 100644
> > --- a/drivers/mtd/maps/physmap_of.c
> > +++ b/drivers/mtd/maps/physmap_of.c
> > @@ -267,13 +267,14 @@ static int __devinit of_flash_probe(struct platform_device *dev)
> > info->list[i].mtd->dev.parent = &dev->dev;
> > }
> >
>
> It seems the error condition should be checked and acted upon here. What
> you looks more like making the code less readable.
>
> > - err = 0;
> > if (info->list_size == 1) {
> > + err = 0;
> > info->cmtd = info->list[0].mtd;
> > } else if (info->list_size > 1) {
> > /*
> > * We detected multiple devices. Concatenate them together.
> > */
> > + err = 0;
> > info->cmtd = mtd_concat_create(mtd_list, info->list_size,
> > dev_name(&dev->dev));
> if (info->cmtd == NULL)
>
--
Best Regards,
Artem Bityutskiy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6798 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20121205/fd828160/attachment-0001.p7s>
More information about the linux-mtd
mailing list