From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935310AbcLUOml (ORCPT ); Wed, 21 Dec 2016 09:42:41 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:53309 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932325AbcLUOmg (ORCPT ); Wed, 21 Dec 2016 09:42:36 -0500 Subject: Re: [PATCH] input: synaptics-rmi4: check for null rmi_dev before it is dereferenced To: Dmitry Torokhov References: <20161220100750.8033-1-colin.king@canonical.com> <20161220212259.GA34190@dtor-ws> Cc: Andrew Duggan , Benjamin Tissoires , Lyude Paul , Dennis Wassenberg , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org From: Colin Ian King Message-ID: <44f9b45f-544f-eb47-49f8-f794f0541b7f@canonical.com> Date: Wed, 21 Dec 2016 14:41:51 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-Version: 1.0 In-Reply-To: <20161220212259.GA34190@dtor-ws> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 20/12/16 21:22, Dmitry Torokhov wrote: > Hi Colin, > > On Tue, Dec 20, 2016 at 10:07:50AM +0000, Colin King wrote: >> From: Colin Ian King >> >> rmi_dev is currently being dereferenced before it null checked, so we >> have a potential null pointer dereference issue with this. Fix this >> by dereferencing rmi_dev after a null check has been performed. >> >> Fixes CoverityScan CID 1391218 ("Dereference before null check") > > I'd rather we removed the NULL check instead. As far as I can see it > can't even be NULL. > >> >> Signed-off-by: Colin Ian King >> --- >> drivers/input/rmi4/rmi_f03.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/input/rmi4/rmi_f03.c b/drivers/input/rmi4/rmi_f03.c >> index 8a7ca3e..008f42a 100644 >> --- a/drivers/input/rmi4/rmi_f03.c >> +++ b/drivers/input/rmi4/rmi_f03.c >> @@ -164,7 +164,7 @@ static int rmi_f03_config(struct rmi_function *fn) >> static int rmi_f03_attention(struct rmi_function *fn, unsigned long *irq_bits) >> { >> struct rmi_device *rmi_dev = fn->rmi_dev; >> - struct rmi_driver_data *drvdata = dev_get_drvdata(&rmi_dev->dev); >> + struct rmi_driver_data *drvdata; >> struct f03_data *f03 = dev_get_drvdata(&fn->dev); >> u16 data_addr = fn->fd.data_base_addr; >> const u8 ob_len = f03->rx_queue_length * RMI_F03_OB_SIZE; >> @@ -178,6 +178,7 @@ static int rmi_f03_attention(struct rmi_function *fn, unsigned long *irq_bits) >> if (!rmi_dev) >> return -ENODEV; >> >> + drvdata = dev_get_drvdata(&rmi_dev->dev); >> if (drvdata->attn_data.data) { >> /* First grab the data passed by the transport device */ >> if (drvdata->attn_data.size < ob_len) { >> -- >> 2.10.2 >> > > Thanks. > Ignore this patch, correct fix just sent.