[PATCH] iio: mxs-lradc: fix a possible NULL dereference

[PATCH] iio: mxs-lradc: fix a possible NULL dereference

[LABBE Corentin]

of_match_device could return NULL, and so cause a NULL pointer
dereference later.

For fixing this problem, we use of_device_get_match_data(), this will
simplify the code a little by using a standard function for
getting the match data.

Reported-by: coverity (CID 1127209)
Signed-off-by: LABBE Corentin <clabbe.montjoie@gmail.com>
---
 drivers/iio/adc/mxs-lradc.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/iio/adc/mxs-lradc.c b/drivers/iio/adc/mxs-lradc.c
index b84d37c..378547c 100644
--- a/drivers/iio/adc/mxs-lradc.c
+++ b/drivers/iio/adc/mxs-lradc.c
@@ -1570,10 +1570,7 @@ static int mxs_lradc_probe_touchscreen(struct mxs_lradc *lradc,
 
 static int mxs_lradc_probe(struct platform_device *pdev)
 {
-	const struct of_device_id *of_id =
-		of_match_device(mxs_lradc_dt_ids, &pdev->dev);
-	const struct mxs_lradc_of_config *of_cfg =
-		&mxs_lradc_of_config[(enum mxs_lradc_id)of_id->data];
+	const struct mxs_lradc_of_config *of_cfg;
 	struct device *dev = &pdev->dev;
 	struct device_node *node = dev->of_node;
 	struct mxs_lradc *lradc;
@@ -1591,7 +1588,8 @@ static int mxs_lradc_probe(struct platform_device *pdev)
 	}
 
 	lradc = iio_priv(iio);
-	lradc->soc = (enum mxs_lradc_id)of_id->data;
+	lradc->soc = (enum mxs_lradc_id)of_device_get_match_data(&pdev->dev);
+	of_cfg = &mxs_lradc_of_config[lradc->soc];
 
 	/* Grab the memory area */
 	iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-- 
2.7.3

Re: [PATCH] iio: mxs-lradc: fix a possible NULL dereference

[Ksenija Stanojević]

Hi Corentin,

On Tue, Aug 16, 2016 at 2:10 PM, LABBE Corentin
<clabbe.montjoie@gmail.com> wrote:
> of_match_device could return NULL, and so cause a NULL pointer
> dereference later.
>
> For fixing this problem, we use of_device_get_match_data(), this will
> simplify the code a little by using a standard function for
> getting the match data.
>
> Reported-by: coverity (CID 1127209)
> Signed-off-by: LABBE Corentin <clabbe.montjoie@gmail.com>
> ---
>  drivers/iio/adc/mxs-lradc.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/iio/adc/mxs-lradc.c b/drivers/iio/adc/mxs-lradc.c
> index b84d37c..378547c 100644
> --- a/drivers/iio/adc/mxs-lradc.c
> +++ b/drivers/iio/adc/mxs-lradc.c
> @@ -1570,10 +1570,7 @@ static int mxs_lradc_probe_touchscreen(struct mxs_lradc *lradc,
>
>  static int mxs_lradc_probe(struct platform_device *pdev)
>  {
> -       const struct of_device_id *of_id =
> -               of_match_device(mxs_lradc_dt_ids, &pdev->dev);
> -       const struct mxs_lradc_of_config *of_cfg =
> -               &mxs_lradc_of_config[(enum mxs_lradc_id)of_id->data];
> +       const struct mxs_lradc_of_config *of_cfg;
>         struct device *dev = &pdev->dev;
>         struct device_node *node = dev->of_node;
>         struct mxs_lradc *lradc;
> @@ -1591,7 +1588,8 @@ static int mxs_lradc_probe(struct platform_device *pdev)
>         }
>
>         lradc = iio_priv(iio);
> -       lradc->soc = (enum mxs_lradc_id)of_id->data;
> +       lradc->soc = (enum mxs_lradc_id)of_device_get_match_data(&pdev->dev);
> +       of_cfg = &mxs_lradc_of_config[lradc->soc];
>
>         /* Grab the memory area */
>         iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
> --

This driver has been split into adc, touchscreen and mfd part. It's currently in
process of review and not yet merged. And it's modified  in such a way that
your changes wouldn't apply anyway. Please see:
https://lkml.org/lkml/2016/8/4/270
I think it's better to wait for modified driver to be merged and after send
patches for it.

Thanks,
Ksenija