From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757001AbcFHUiw (ORCPT ); Wed, 8 Jun 2016 16:38:52 -0400 Received: from bombadil.infradead.org ([198.137.202.9]:43887 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756777AbcFHUit (ORCPT ); Wed, 8 Jun 2016 16:38:49 -0400 Date: Wed, 8 Jun 2016 13:38:46 -0700 From: Darren Hart To: Vincent =?iso-8859-1?Q?Stehl=E9?= Cc: platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, Sujith Thomas , Zhang Rui , Len Brown , Rafael Wysocki Subject: Re: [PATCH] intel_menlow: prevent NULL pointer dereference Message-ID: <20160608203846.GG28348@f23x64.localdomain> References: <1464186011-732-1-git-send-email-vincent.stehle@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1464186011-732-1-git-send-email-vincent.stehle@intel.com> User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 25, 2016 at 04:20:11PM +0200, Vincent Stehlé wrote: > The function acpi_driver_data() will dereference its parameter; make sure > to check for NULL pointer before we call it. +Rafael Under what circumstances can the .remove op be called with a NULL struct acpi_device * as a parameter? From what I can see, most acpi_* calls accpeting an acpi_device rely on it not being null, and they are regularly called from driver remove functions. Did you observe an explicit failure or can you describe a call path where this can occur? > > Signed-off-by: Vincent Stehlé > Cc: Sujith Thomas > Cc: Darren Hart > Cc: Zhang Rui > Cc: Len Brown > --- > drivers/platform/x86/intel_menlow.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/platform/x86/intel_menlow.c b/drivers/platform/x86/intel_menlow.c > index 0a919d8..185a1bd 100644 > --- a/drivers/platform/x86/intel_menlow.c > +++ b/drivers/platform/x86/intel_menlow.c > @@ -196,9 +196,13 @@ static int intel_menlow_memory_add(struct acpi_device *device) > > static int intel_menlow_memory_remove(struct acpi_device *device) > { > - struct thermal_cooling_device *cdev = acpi_driver_data(device); > + struct thermal_cooling_device *cdev; > + > + if (!device) > + return -EINVAL; > > - if (!device || !cdev) > + cdev = acpi_driver_data(device); > + if (!cdev) > return -EINVAL; > > sysfs_remove_link(&device->dev.kobj, "thermal_cooling"); > -- > 2.8.1 > > -- Darren Hart Intel Open Source Technology Center