pata_pxa: Fix null-ptr-deref in pxa_ata_probe()

[PATCH v1] [ARM] pata_pxa: Fix null-ptr-deref in pxa_ata_probe()

Posted by Henry Martin 10 months, 1 week ago

devm_ioremap() returns NULL on error. Currently, pxa_ata_probe() does
not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_ioremap() to prevent this issue.

Fixes: 2dc6c6f15da9 ("[ARM] pata_pxa: DMA-capable PATA driver")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 drivers/ata/pata_pxa.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
index 434f380114af..cc76290a3b1a 100644
--- a/drivers/ata/pata_pxa.c
+++ b/drivers/ata/pata_pxa.c
@@ -223,11 +223,16 @@ static int pxa_ata_probe(struct platform_device *pdev)
 
 	ap->ioaddr.cmd_addr	= devm_ioremap(&pdev->dev, cmd_res->start,
 						resource_size(cmd_res));
+	if (!ap->ioaddr.cmd_addr)
+		return -ENOMEM;
 	ap->ioaddr.ctl_addr	= devm_ioremap(&pdev->dev, ctl_res->start,
 						resource_size(ctl_res));
+	if (!ap->ioaddr.ctl_addr)
+		return -ENOMEM;
 	ap->ioaddr.bmdma_addr	= devm_ioremap(&pdev->dev, dma_res->start,
 						resource_size(dma_res));
-
+	if (!ap->ioaddr.bmdma_addr)
+		return -ENOMEM;
 	/*
 	 * Adjust register offsets
 	 */
-- 
2.34.1

Re: [PATCH v1] [ARM] pata_pxa: Fix null-ptr-deref in pxa_ata_probe()

Posted by Damien Le Moal 10 months, 1 week ago

On 4/3/25 12:45 PM, Henry Martin wrote:
> devm_ioremap() returns NULL on error. Currently, pxa_ata_probe() does
> not check for this case, which results in a NULL pointer dereference.

, which can result in...

> 
> Add NULL check after devm_ioremap() to prevent this issue.
> 
> Fixes: 2dc6c6f15da9 ("[ARM] pata_pxa: DMA-capable PATA driver")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  drivers/ata/pata_pxa.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
> index 434f380114af..cc76290a3b1a 100644
> --- a/drivers/ata/pata_pxa.c
> +++ b/drivers/ata/pata_pxa.c
> @@ -223,11 +223,16 @@ static int pxa_ata_probe(struct platform_device *pdev)
>  
>  	ap->ioaddr.cmd_addr	= devm_ioremap(&pdev->dev, cmd_res->start,
>  						resource_size(cmd_res));
> +	if (!ap->ioaddr.cmd_addr)
> +		return -ENOMEM;
>  	ap->ioaddr.ctl_addr	= devm_ioremap(&pdev->dev, ctl_res->start,
>  						resource_size(ctl_res));
> +	if (!ap->ioaddr.ctl_addr)
> +		return -ENOMEM;
>  	ap->ioaddr.bmdma_addr	= devm_ioremap(&pdev->dev, dma_res->start,
>  						resource_size(dma_res));
> -
> +	if (!ap->ioaddr.bmdma_addr)
> +		return -ENOMEM;

Please keep the blank line here.

>  	/*
>  	 * Adjust register offsets
>  	 */


-- 
Damien Le Moal
Western Digital Research

Re: [PATCH v1] [ARM] pata_pxa: Fix null-ptr-deref in pxa_ata_probe()

Posted by Damien Le Moal 10 months, 1 week ago

On 4/4/25 12:58 PM, Damien Le Moal wrote:
> On 4/3/25 12:45 PM, Henry Martin wrote:

The patch title should be:

ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()

>> devm_ioremap() returns NULL on error. Currently, pxa_ata_probe() does
>> not check for this case, which results in a NULL pointer dereference.
> 
> , which can result in...
> 
>>
>> Add NULL check after devm_ioremap() to prevent this issue.
>>
>> Fixes: 2dc6c6f15da9 ("[ARM] pata_pxa: DMA-capable PATA driver")
>> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
>> ---
>>  drivers/ata/pata_pxa.c | 7 ++++++-
>>  1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
>> index 434f380114af..cc76290a3b1a 100644
>> --- a/drivers/ata/pata_pxa.c
>> +++ b/drivers/ata/pata_pxa.c
>> @@ -223,11 +223,16 @@ static int pxa_ata_probe(struct platform_device *pdev)
>>  
>>  	ap->ioaddr.cmd_addr	= devm_ioremap(&pdev->dev, cmd_res->start,
>>  						resource_size(cmd_res));
>> +	if (!ap->ioaddr.cmd_addr)
>> +		return -ENOMEM;
>>  	ap->ioaddr.ctl_addr	= devm_ioremap(&pdev->dev, ctl_res->start,
>>  						resource_size(ctl_res));
>> +	if (!ap->ioaddr.ctl_addr)
>> +		return -ENOMEM;
>>  	ap->ioaddr.bmdma_addr	= devm_ioremap(&pdev->dev, dma_res->start,
>>  						resource_size(dma_res));
>> -
>> +	if (!ap->ioaddr.bmdma_addr)
>> +		return -ENOMEM;
> 
> Please keep the blank line here.
> 
>>  	/*
>>  	 * Adjust register offsets
>>  	 */
> 
> 


-- 
Damien Le Moal
Western Digital Research

[PATCH v2] ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()

Posted by Henry Martin 10 months, 1 week ago

devm_ioremap() returns NULL on error. Currently, pxa_ata_probe() does
not check for this case, which can result in a NULL pointer dereference.

Add NULL check after devm_ioremap() to prevent this issue.

Fixes: 2dc6c6f15da9 ("[ARM] pata_pxa: DMA-capable PATA driver")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
V1 -> V2: Correct commit message and keep a blank line after check.

 drivers/ata/pata_pxa.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
index 434f380114af..03dbaf4a13a7 100644
--- a/drivers/ata/pata_pxa.c
+++ b/drivers/ata/pata_pxa.c
@@ -223,10 +223,16 @@ static int pxa_ata_probe(struct platform_device *pdev)
 
 	ap->ioaddr.cmd_addr	= devm_ioremap(&pdev->dev, cmd_res->start,
 						resource_size(cmd_res));
+	if (!ap->ioaddr.cmd_addr)
+		return -ENOMEM;
 	ap->ioaddr.ctl_addr	= devm_ioremap(&pdev->dev, ctl_res->start,
 						resource_size(ctl_res));
+	if (!ap->ioaddr.ctl_addr)
+		return -ENOMEM;
 	ap->ioaddr.bmdma_addr	= devm_ioremap(&pdev->dev, dma_res->start,
 						resource_size(dma_res));
+	if (!ap->ioaddr.bmdma_addr)
+		return -ENOMEM;
 
 	/*
 	 * Adjust register offsets
-- 
2.34.1

Re: [PATCH v2] ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()

Posted by Damien Le Moal 10 months ago

On 4/4/25 3:14 PM, Henry Martin wrote:
> devm_ioremap() returns NULL on error. Currently, pxa_ata_probe() does
> not check for this case, which can result in a NULL pointer dereference.
> 
> Add NULL check after devm_ioremap() to prevent this issue.
> 
> Fixes: 2dc6c6f15da9 ("[ARM] pata_pxa: DMA-capable PATA driver")
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>

Applied to for-6.15-fixes. Thanks !

-- 
Damien Le Moal
Western Digital Research

Re: [PATCH v2] ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()

Posted by Markus Elfring 10 months, 1 week ago

…
> Add NULL check after devm_ioremap() to prevent this issue.

May you omit the word “potential” from the summary phrase?


…
> ---
> V1 -> V2: Correct commit message and keep a blank line after check.

Can such an adjustment become helpful for any more places?

Regards,
Markus

Re: [PATCH] [ARM] pata_pxa: Fix null-ptr-deref in pxa_ata_probe()

Posted by Markus Elfring 10 months, 1 week ago

…
> Add NULL check after devm_ioremap() to prevent this issue.

Can a summary phrase like “Prevent null pointer dereference in pxa_ata_probe()”
be a bit nicer?


…
> +++ b/drivers/ata/pata_pxa.c
> @@ -223,11 +223,16 @@ static int pxa_ata_probe(struct platform_device *pdev)
>
>  	ap->ioaddr.cmd_addr	= devm_ioremap(&pdev->dev, cmd_res->start,
>  						resource_size(cmd_res));
> +	if (!ap->ioaddr.cmd_addr)
> +		return -ENOMEM;

Can a blank line be desirable after such a statement?

Regards,
Markus