Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: imx-jpeg: Fix potential error pointer dereference in detach_pm()

The proble is on the first line:

if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))

If jpeg->pd_dev[i] is an error pointer, then passing it to
pm_runtime_suspended() will lead to an Oops. The other conditions
check for both error pointers and NULL, but it would be more clear to
use the IS_ERR_OR_NULL() check for that.

Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended before detach them")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Ming Qian <ming.qian@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

authored by

Dan Carpenter and committed by
Hans Verkuil
1378ffec 27dcdb63

+4 -3
+4 -3
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
··· 2677 2677 int i; 2678 2678 2679 2679 for (i = 0; i < jpeg->num_domains; i++) { 2680 - if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) 2680 + if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) && 2681 + !pm_runtime_suspended(jpeg->pd_dev[i])) 2681 2682 pm_runtime_force_suspend(jpeg->pd_dev[i]); 2682 - if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i])) 2683 + if (!IS_ERR_OR_NULL(jpeg->pd_link[i])) 2683 2684 device_link_del(jpeg->pd_link[i]); 2684 - if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i])) 2685 + if (!IS_ERR_OR_NULL(jpeg->pd_dev[i])) 2685 2686 dev_pm_domain_detach(jpeg->pd_dev[i], true); 2686 2687 jpeg->pd_dev[i] = NULL; 2687 2688 jpeg->pd_link[i] = NULL;