[PATCH 1/1] Input: cyttsp - Fix check after pointer dereferencing

From: Javier Martinez Canillas <redacted>

In the cyttsp_probe() function the struct device *dev pointer was
dereferenced before checking if it was NULL.

Now dev is never NULL since both I2C and SPI bus drivers pass a pointer to a
member of an previously allocated structure. But others bus drivers can do
it differently so is better to sanity check instead of trust in the callers.

Reported-by: Dan Carpenter <redacted>
Signed-off-by: Javier Martinez Canillas <javier@dowhile0.org>
---
 drivers/input/touchscreen/cyttsp_core.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/cyttsp_core.c b/drivers/input/touchscreen/cyttsp_core.c
index 8be2247..071e5ae8 100644
--- a/drivers/input/touchscreen/cyttsp_core.c
+++ b/drivers/input/touchscreen/cyttsp_core.c

@@ -518,12 +518,19 @@ static void cyttsp_close(struct input_dev *dev)
 struct cyttsp *cyttsp_probe(const struct cyttsp_bus_ops *bus_ops,
 			    struct device *dev, int irq, size_t xfer_buf_size)
 {
-	const struct cyttsp_platform_data *pdata = dev->platform_data;
+	const struct cyttsp_platform_data *pdata;
 	struct cyttsp *ts;
 	struct input_dev *input_dev;
 	int error;
 
-	if (!dev || !bus_ops || !pdata || !pdata->name || irq <= 0) {
+	if (!dev || !bus_ops || !dev->platform_data || irq <= 0) {
+		error = -EINVAL;
+		goto err_out;
+	}
+
+	pdata = dev->platform_data;
+
+	if (!pdata->name) {
 		error = -EINVAL;
 		goto err_out;
 	}

-- 
1.7.7.6

On Wed, Feb 15, 2012 at 11:42 AM, Javier Martinez Canillas
[off-list ref] wrote:

Hello,

Any feedback on this?

Is not a bug with today cyttsp driver since both I2C and SPI transport
drivers can't pass a NULL pointer, but I think Dan is right that is
better to sanity check since others transport drivers can be added in
the future.

Or this check is being to paranoiac?

Regards,
Javier
--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Hi Javier,

On Wed, Feb 15, 2012 at 11:42:52AM +0100, Javier Martinez Canillas wrote:

From: Javier Martinez Canillas <redacted>

In the cyttsp_probe() function the struct device *dev pointer was
dereferenced before checking if it was NULL.

Now dev is never NULL since both I2C and SPI bus drivers pass a pointer to a
member of an previously allocated structure. But others bus drivers can do
it differently so is better to sanity check instead of trust in the callers.

I already have a patch that simply removes the checks ofr dev and
bus_ops - cyttsp_probe is only called by bus-specific code and they are
not coming form platform data so there is no chance they will be NULL.
And anyone writing a new bus intefcae will get a nice oops first time
they try loading the module so they'll see the problem right away too.

Thanks.

-- 
Dmitry

On Sun, Mar 4, 2012 at 4:41 PM, Dmitry Torokhov
[off-list ref] wrote:

Hi Javier,

On Wed, Feb 15, 2012 at 11:42:52AM +0100, Javier Martinez Canillas wrote:

quoted

From: Javier Martinez Canillas <redacted>

In the cyttsp_probe() function the struct device *dev pointer was
dereferenced before checking if it was NULL.

Now dev is never NULL since both I2C and SPI bus drivers pass a pointer to a
member of an previously allocated structure. But others bus drivers can do
it differently so is better to sanity check instead of trust in the callers.

I already have a patch that simply removes the checks ofr dev and
bus_ops - cyttsp_probe is only called by bus-specific code and they are
not coming form platform data so there is no chance they will be NULL.
And anyone writing a new bus intefcae will get a nice oops first time
they try loading the module so they'll see the problem right away too.

Thanks.

--
Dmitry

Yes, I agree with you. Since cyttsp_probe is only called by bus
specific code, removing the checks is better.

Thanks and best regards,
Javier