| Message ID | 1458687114-9390-1-git-send-email-vz@mleia.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 23/03/16 00:51, Vladimir Zapolskiy wrote: > The change fixes a check of gpio_to_desc() return value, the function > returns either a valid pointer to struct gpio_desc or NULL, this makes > IS_ERR() check invalid and may lead to a NULL pointer dereference in > runtime. > > Signed-off-by: Vladimir Zapolskiy <vz@mleia.com> > --- > .../fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c | 12 ++++-------- > 1 file changed, 4 insertions(+), 8 deletions(-) > > diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c > index abfd1f6..1954ec9 100644 > --- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c > +++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c > @@ -200,20 +200,16 @@ static struct omap_dss_driver sharp_ls_ops = { > static int sharp_ls_get_gpio(struct device *dev, int gpio, unsigned long flags, > char *desc, struct gpio_desc **gpiod) > { > - struct gpio_desc *gd; > int r; > > - *gpiod = NULL; > - > r = devm_gpio_request_one(dev, gpio, flags, desc); > - if (r) > + if (r) { > + *gpiod = NULL; > return r == -ENOENT ? 0 : r; > + } > > - gd = gpio_to_desc(gpio); > - if (IS_ERR(gd)) > - return PTR_ERR(gd) == -ENOENT ? 0 : PTR_ERR(gd); > + *gpiod = gpio_to_desc(gpio); > > - *gpiod = gd; > return 0; > } > > Thanks, queued for 4.6 fixes. Tomi
diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c index abfd1f6..1954ec9 100644 --- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c +++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c @@ -200,20 +200,16 @@ static struct omap_dss_driver sharp_ls_ops = { static int sharp_ls_get_gpio(struct device *dev, int gpio, unsigned long flags, char *desc, struct gpio_desc **gpiod) { - struct gpio_desc *gd; int r; - *gpiod = NULL; - r = devm_gpio_request_one(dev, gpio, flags, desc); - if (r) + if (r) { + *gpiod = NULL; return r == -ENOENT ? 0 : r; + } - gd = gpio_to_desc(gpio); - if (IS_ERR(gd)) - return PTR_ERR(gd) == -ENOENT ? 0 : PTR_ERR(gd); + *gpiod = gpio_to_desc(gpio); - *gpiod = gd; return 0; }
The change fixes a check of gpio_to_desc() return value, the function returns either a valid pointer to struct gpio_desc or NULL, this makes IS_ERR() check invalid and may lead to a NULL pointer dereference in runtime. Signed-off-by: Vladimir Zapolskiy <vz@mleia.com> --- .../fbdev/omap2/omapfb/displays/panel-sharp-ls037v7dw01.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)