[PATCH] Input: cyttsp4 - fix potential NULL pointer dereference in cyttsp4_watchdog_timer()

From: Wei Yongjun <redacted>

The dereference should be moved below the NULL test.

Signed-off-by: Wei Yongjun <redacted>
---
 drivers/input/touchscreen/cyttsp4_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index 963da05..ffa8e35 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c

@@ -1244,11 +1244,11 @@ static void cyttsp4_watchdog_timer(unsigned long handle)
 {
 	struct cyttsp4 *cd = (struct cyttsp4 *)handle;
 
-	dev_vdbg(cd->dev, "%s: Watchdog timer triggered\n", __func__);
-
 	if (!cd)
 		return;
 
+	dev_vdbg(cd->dev, "%s: Watchdog timer triggered\n", __func__);
+
 	if (!work_pending(&cd->watchdog_work))
 		schedule_work(&cd->watchdog_work);
 

Wei Yongjun [off-list ref] wrote:

Actually this test does not make any sense and we should rather remove it.

+	dev_vdbg(cd->dev, "%s: Watchdog timer triggered\n", __func__);
+
	if (!work_pending(&cd->watchdog_work))
		schedule_work(&cd->watchdog_work);

Hi Wei,
Thanks.

-- 
Dmitry

On 08/26/2013 08:26 AM, Dmitry Torokhov wrote:

Wei Yongjun [off-list ref] wrote:

quoted

From: Wei Yongjun <redacted>

The dereference should be moved below the NULL test.

Signed-off-by: Wei Yongjun <redacted>
---
drivers/input/touchscreen/cyttsp4_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/touchscreen/cyttsp4_core.c

b/drivers/input/touchscreen/cyttsp4_core.c
index 963da05..ffa8e35 100644

--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c

@@ -1244,11 +1244,11 @@ static void cyttsp4_watchdog_timer(unsigned

long handle)
{
     struct cyttsp4 *cd = (struct cyttsp4 *)handle;

-    dev_vdbg(cd->dev, "%s: Watchdog timer triggered\n", __func__);
-
     if (!cd)
             return;

Actually this test does not make any sense and we should rather remove it.

Agreed on removing it. For cases "cd" can be NULL/invalid, watchdog
already stopped:
1- in probe(), when timer set, cd allocated and NULL check done.
2- in probe(), in error path after timer set, watchdog stopped before
"cd" freed
3- in cyttsp4_remove(), watchdog stopped before "cd" freed

quoted

+    dev_vdbg(cd->dev, "%s: Watchdog timer triggered\n", __func__);
+
     if (!work_pending(&cd->watchdog_work))
             schedule_work(&cd->watchdog_work);

Hi Wei,
Thanks.

This message and any attachments may contain Cypress (or its subsidiaries) confidential information. If it has been received in error, please advise the sender and immediately delete this message.