From: Alex Elder <elder@ieee.org>
To: Dan Carpenter <dan.carpenter@linaro.org>,
Mikhail Lobanov <m.lobanov@rosalinux.ru>,
rmfrfs@gmail.com
Cc: greybus-dev@lists.linaro.org, linux-staging@lists.linux.dev,
linux-kernel@vger.kernel.org
Subject: Re: [greybus-dev] Re: [PATCH] greybus: Fix deref of NULL in __gb_lights_flash_brightness_set
Date: Sat, 2 Mar 2024 08:57:17 -0600 [thread overview]
Message-ID: <36a4d208-9945-4a65-bdf1-d8309d779e63@ieee.org> (raw)
In-Reply-To: <7ef732ad-a50f-4cf5-8322-376f42eb051b@moroto.mountain>
On 3/2/24 3:59 AM, Dan Carpenter wrote:
> On Fri, Mar 01, 2024 at 02:04:24PM -0500, Mikhail Lobanov wrote:
>> Dereference of null pointer in the __gb_lights_flash_brightness_set function.
>> Assigning the channel the result of executing the get_channel_from_mode function
>> without checking for NULL may result in an error.
>
> get_channel_from_mode() can only return NULL when light->channels_count
> is zero.
>
> Although get_channel_from_mode() seems buggy to me. If it can't
> find the correct mode, it just returns the last channel. So potentially
> it should be made to return NULL.
I agree with you. This looks quite wrong to me, and I
like your fix, *except* there is also no need to check
whether the channel pointer is null inside the loop.
It's the address of an object, and will always be non-null.
static struct gb_channel *
get_channel_from_mode(struct gb_light *light, u32 mode)
{
struct gb_channel *channel;
u32 i;
for (i = 0; i < light->channels_count; i++) {
channel = &light->channels[i];
if (channel->mode == mode)
return channel;
}
return NULL;
}
Rui, could you please confirm what Dan says (and his
proposed change) was your intention?
If so (and assuming you also fix the check for a null
channel pointer inside the loop):
Reviewed-by: Alex Elder <elder@linaro.org>
-Alex
>
> diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
> index d62f97249aca..acd435f5d25d 100644
> --- a/drivers/staging/greybus/light.c
> +++ b/drivers/staging/greybus/light.c
> @@ -95,15 +95,15 @@ static struct led_classdev *get_channel_cdev(struct gb_channel *channel)
> static struct gb_channel *get_channel_from_mode(struct gb_light *light,
> u32 mode)
> {
> - struct gb_channel *channel = NULL;
> + struct gb_channel *channel;
> int i;
>
> for (i = 0; i < light->channels_count; i++) {
> channel = &light->channels[i];
> if (channel && channel->mode == mode)
> - break;
> + return channel;
> }
> - return channel;
> + return NULL;
> }
>
> static int __gb_lights_flash_intensity_set(struct gb_channel *channel,
> _______________________________________________
> greybus-dev mailing list -- greybus-dev@lists.linaro.org
> To unsubscribe send an email to greybus-dev-leave@lists.linaro.org
next prev parent reply other threads:[~2024-03-02 14:57 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-01 19:04 [PATCH] greybus: Fix deref of NULL in __gb_lights_flash_brightness_set Mikhail Lobanov
2024-03-02 9:59 ` Dan Carpenter
2024-03-02 14:57 ` Alex Elder [this message]
2024-03-02 15:21 ` [greybus-dev] " Rui Miguel Silva
2024-03-02 15:23 ` Rui Miguel Silva
2024-03-04 6:29 ` Dan Carpenter
2024-03-02 15:18 ` Rui Miguel Silva
2024-03-02 15:31 ` [greybus-dev] " Alex Elder
2024-03-02 16:35 ` Rui Miguel Silva
2024-03-04 13:30 ` Alex Elder
2024-03-04 13:30 ` Alex Elder
2024-03-06 9:21 ` Rui Miguel Silva
2024-03-06 15:29 ` Михаил Лобанов
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=36a4d208-9945-4a65-bdf1-d8309d779e63@ieee.org \
--to=elder@ieee.org \
--cc=dan.carpenter@linaro.org \
--cc=greybus-dev@lists.linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=m.lobanov@rosalinux.ru \
--cc=rmfrfs@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).