Commit d47c9644 authored by Dan Carpenter's avatar Dan Carpenter Committed by Wentao Guan
Browse files

media: imx-jpeg: Fix potential error pointer dereference in detach_pm() 

stable inclusion
from stable-v6.6.76
commit 1b2af918bb714937a8be6cb637f528585461cd98
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBW08Q

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b2af918bb714937a8be6cb637f528585461cd98



--------------------------------

commit 1378ffec30367233152b7dbf4fa6a25ee98585d1 upstream.

The proble is on the first line:

	if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))

If jpeg->pd_dev[i] is an error pointer, then passing it to
pm_runtime_suspended() will lead to an Oops.  The other conditions
check for both error pointers and NULL, but it would be more clear to
use the IS_ERR_OR_NULL() check for that.

Fixes: fd0af4cd35da ("media: imx-jpeg: Ensure power suppliers be suspended before detach them")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarMing Qian <ming.qian@nxp.com>
Signed-off-by: default avatarHans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 1b2af918bb714937a8be6cb637f528585461cd98)
Signed-off-by: default avatarWentao Guan <guanwentao@uniontech.com>
parent 5312ad1b

drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c

+4 −3
Original line number Diff line number Diff line
@@ -2674,11 +2674,12 @@ static void mxc_jpeg_detach_pm_domains(struct mxc_jpeg_dev *jpeg) 
	int i;



	for (i = 0; i < jpeg->num_domains; i++) {

		if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))

		if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]) &&

		    !pm_runtime_suspended(jpeg->pd_dev[i]))

			pm_runtime_force_suspend(jpeg->pd_dev[i]);

		if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i]))

		if (!IS_ERR_OR_NULL(jpeg->pd_link[i]))

			device_link_del(jpeg->pd_link[i]);

		if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i]))

		if (!IS_ERR_OR_NULL(jpeg->pd_dev[i]))

			dev_pm_domain_detach(jpeg->pd_dev[i], true);

		jpeg->pd_dev[i] = NULL;

		jpeg->pd_link[i] = NULL;