[PATCH][next] pinctrl: th1520: Dereference pointer only after NULL check

Everest K.C. posted 1 patch 1 month, 1 week ago
drivers/pinctrl/pinctrl-th1520.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
[PATCH][next] pinctrl: th1520: Dereference pointer only after NULL check
Posted by Everest K.C. 1 month, 1 week ago
The pointer `func` is dereferenced before NULL check.
Move the dereference after the NULL check.

This issue was reported by Coverity Scan.
Report:
CID 1600802: (#1 of 1): Dereference before null check
(REVERSE_INULL)
check_after_deref: Null-checking func suggests that it
may be null, but it has already been dereferenced on all
paths leading to the check.

Fixes: 1fc30cd92770 ("pinctrl: th1520: Factor out casts")
Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
---
 drivers/pinctrl/pinctrl-th1520.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/pinctrl-th1520.c b/drivers/pinctrl/pinctrl-th1520.c
index 7474d8da32f9..07f8b51fb294 100644
--- a/drivers/pinctrl/pinctrl-th1520.c
+++ b/drivers/pinctrl/pinctrl-th1520.c
@@ -803,11 +803,13 @@ static int th1520_pinmux_set_mux(struct pinctrl_dev *pctldev,
 {
 	struct th1520_pinctrl *thp = pinctrl_dev_get_drvdata(pctldev);
 	const struct function_desc *func = pinmux_generic_get_function(pctldev, fsel);
-	enum th1520_muxtype muxtype = (uintptr_t)func->data;
+	enum th1520_muxtype muxtype;
 
 	if (!func)
 		return -EINVAL;
 
+	muxtype = (uintptr_t)func->data;
+
 	return th1520_pinmux_set(thp, thp->desc.pins[gsel].number,
 				 th1520_pad_muxdata(thp->desc.pins[gsel].drv_data),
 				 muxtype);
-- 
2.43.0
Re: [PATCH][next] pinctrl: th1520: Dereference pointer only after NULL check
Posted by Shuah Khan 1 month, 1 week ago
On 10/16/24 07:42, Everest K.C. wrote:
> The pointer `func` is dereferenced before NULL check.
> Move the dereference after the NULL check.

Change log looks fine.

Short log that clearly says it is a fix would be better:

Fix potential null pointer defereference

> 
> This issue was reported by Coverity Scan.
> Report:
> CID 1600802: (#1 of 1): Dereference before null check
> (REVERSE_INULL)
> check_after_deref: Null-checking func suggests that it
> may be null, but it has already been dereferenced on all
> paths leading to the check.
> 
> Fixes: 1fc30cd92770 ("pinctrl: th1520: Factor out casts")
> Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
> ---
>   drivers/pinctrl/pinctrl-th1520.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/pinctrl/pinctrl-th1520.c b/drivers/pinctrl/pinctrl-th1520.c
> index 7474d8da32f9..07f8b51fb294 100644
> --- a/drivers/pinctrl/pinctrl-th1520.c
> +++ b/drivers/pinctrl/pinctrl-th1520.c
> @@ -803,11 +803,13 @@ static int th1520_pinmux_set_mux(struct pinctrl_dev *pctldev,
>   {
>   	struct th1520_pinctrl *thp = pinctrl_dev_get_drvdata(pctldev);
>   	const struct function_desc *func = pinmux_generic_get_function(pctldev, fsel);
> -	enum th1520_muxtype muxtype = (uintptr_t)func->data;
> +	enum th1520_muxtype muxtype;
>   
>   	if (!func)
>   		return -EINVAL;
>   
> +	muxtype = (uintptr_t)func->data;
> +
>   	return th1520_pinmux_set(thp, thp->desc.pins[gsel].number,
>   				 th1520_pad_muxdata(thp->desc.pins[gsel].drv_data),
>   				 muxtype);

Otherwise looks good to me. With the change to short log:

Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>

thanks,
-- Shuah
Re: [PATCH][next] pinctrl: th1520: Dereference pointer only after NULL check
Posted by Everest K.C. 1 month, 1 week ago
On Wed, Oct 16, 2024 at 3:00 PM Shuah Khan <skhan@linuxfoundation.org> wrote:
>
> On 10/16/24 07:42, Everest K.C. wrote:
> > The pointer `func` is dereferenced before NULL check.
> > Move the dereference after the NULL check.
>
> Change log looks fine.
>
> Short log that clearly says it is a fix would be better:
>
> Fix potential null pointer defereference
>
> >
> > This issue was reported by Coverity Scan.
> > Report:
> > CID 1600802: (#1 of 1): Dereference before null check
> > (REVERSE_INULL)
> > check_after_deref: Null-checking func suggests that it
> > may be null, but it has already been dereferenced on all
> > paths leading to the check.
> >
> > Fixes: 1fc30cd92770 ("pinctrl: th1520: Factor out casts")
> > Signed-off-by: Everest K.C. <everestkc@everestkc.com.np>
> > ---
> >   drivers/pinctrl/pinctrl-th1520.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/pinctrl/pinctrl-th1520.c b/drivers/pinctrl/pinctrl-th1520.c
> > index 7474d8da32f9..07f8b51fb294 100644
> > --- a/drivers/pinctrl/pinctrl-th1520.c
> > +++ b/drivers/pinctrl/pinctrl-th1520.c
> > @@ -803,11 +803,13 @@ static int th1520_pinmux_set_mux(struct pinctrl_dev *pctldev,
> >   {
> >       struct th1520_pinctrl *thp = pinctrl_dev_get_drvdata(pctldev);
> >       const struct function_desc *func = pinmux_generic_get_function(pctldev, fsel);
> > -     enum th1520_muxtype muxtype = (uintptr_t)func->data;
> > +     enum th1520_muxtype muxtype;
> >
> >       if (!func)
> >               return -EINVAL;
> >
> > +     muxtype = (uintptr_t)func->data;
> > +
> >       return th1520_pinmux_set(thp, thp->desc.pins[gsel].number,
> >                                th1520_pad_muxdata(thp->desc.pins[gsel].drv_data),
> >                                muxtype);
>
> Otherwise looks good to me. With the change to short log:
>
> Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
The patch sent by another patch submitter has already been
applied for this issue.
https://lore.kernel.org/all/20241016155655.334518-1-colin.i.king@gmail.com/
> thanks,
> -- Shuah
>
Thanks,
Everest K.C.