On Wed, Jul 29, 2020 at 06:13:44PM +0300, Andy Shevchenko wrote:
> On Wed, Jul 29, 2020 at 5:00 PM Cengiz Can <cengiz@xxxxxxxxxx> wrote:
> >
> > `find_gmin_subdev` function that returns a pointer to `struct
> > gmin_subdev` can return NULL.
> >
> > In `gmin_v2p8_ctrl` there's a call to this function but the possibility
> > of a NULL was not checked before its being dereferenced. ie:
> >
> > ```
> > /* Acquired here --------v */
> > struct gmin_subdev *gs = find_gmin_subdev(subdev);
> > int ret;
> > int value;
> >
> > /* v------Dereferenced here */
> > if (gs->v2p8_gpio >= 0) {
> > pr_info("atomisp_gmin_platform: 2.8v power on GPIO %d\n",
> > gs->v2p8_gpio);
> > ret = gpio_request(gs->v2p8_gpio, "camera_v2p8");
> > if (!ret)
> > ret = gpio_direction_output(gs->v2p8_gpio, 0);
> > if (ret)
> > pr_err("V2P8 GPIO initialization failed\n");
> > }
> > ```
> >
> > I have moved the NULL check before deref point.
>
> "Move the NULL check..."
> See Submitting Patches documentation how to avoid "This patch", "I", "we", etc.
I always feel like this is a pointless requirement. We're turning into
bureaucracts.
>
> > diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
> > index 0df46a1af5f0..8e9c5016f299 100644
> > --- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
> > +++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
> > @@ -871,6 +871,11 @@ static int gmin_v2p8_ctrl(struct v4l2_subdev *subdev, int on)
> > int ret;
> > int value;
> >
> > + if (!gs) {
> > + pr_err("Unable to find gmin subdevice\n");
>
> > + return -EINVAL;
>
> And here is a change of semantics...
Yeah. The change of semantics should be documented in the commit
message, but it's actually correct. I discussed this with Mauro earlier
but my bug reporting script didn't CC a mailing list and I didn't
catch it. Mauro suggested:
53 > Yet, it could make sense to have something like:
54 >
55 > if (WARN_ON(!gs))
56 > return -ENODEV;
57 >
58 > at the beginning of the functions that call find_gmin_subdev().
regards,
dan carpenter
