On 8/1/2024 22:38, Ma Ke wrote:
> In altr_s10_sdram_check_ecc_deps(), of_get_address() may return NULL which
> is later dereferenced. Fix this bug by adding NULL check.
>
Only of_get_address() has been mentioned here but the patch also tries to
fix a possible NULL pointer dereference arising from of_translate_address().
Also, a some context on how this was discovered might be helpful.
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: e1bca853dddc ("EDAC/altera: Add SDRAM ECC check for U-Boot")
> Signed-off-by: Ma Ke <make24@xxxxxxxxxxx>
> ---
> drivers/edac/altera_edac.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c
> index fe89f5c4837f..d6bf0eebeb41 100644
> --- a/drivers/edac/altera_edac.c
> +++ b/drivers/edac/altera_edac.c
> @@ -1086,6 +1086,7 @@ static int altr_s10_sdram_check_ecc_deps(struct altr_edac_device_dev *device)
> struct arm_smccc_res result;
> struct device_node *np;
> phys_addr_t sdram_addr;
> + const __be32 *sdram_addrp;
> u32 read_reg;
> int ret;
>
> @@ -1093,8 +1094,14 @@ static int altr_s10_sdram_check_ecc_deps(struct altr_edac_device_dev *device)
> if (!np)
> goto sdram_err;
>
> - sdram_addr = of_translate_address(np, of_get_address(np, 0,
> - NULL, NULL));
> + sdram_addrp = of_get_address(np, 0, NULL, NULL);
> + if (!sdram_addrp)
> + return -EINVAL;
> +
> + sdram_addr = of_translate_address(np, sdram_addrp);
> + if (!sdram_addr)
> + return -EINVAL;
> +
Will sdram_addr here ever be NULL?
IIUC, of_translate_address() will return OF_BAD_ADDR in case the translation fails.
Perhaps, a more prudent check here, if required, would be
if (sdram_addr == OF_BAD_ADDR)
--
Thanks,
Avadhut Naik
