linux/drivers/i2c
Krzysztof Kozlowski 2499042326 i2c: s3c2410: fix possible NULL pointer deref on read message after write
Interrupt handler processes multiple message write requests one after
another, till the driver message queue is drained.  However if driver
encounters a read message without preceding START, it stops the I2C
transfer as it is an invalid condition for the controller.  At least the
comment describes a requirement "the controller forces us to send a new
START when we change direction".  This stop results in clearing the
message queue (i2c->msg = NULL).

The code however immediately jumped back to label "retry_write" which
dereferenced the "i2c->msg" making it a possible NULL pointer
dereference.

The Coverity analysis:
1. Condition !is_msgend(i2c), taking false branch.
   if (!is_msgend(i2c)) {

2. Condition !is_lastmsg(i2c), taking true branch.
   } else if (!is_lastmsg(i2c)) {

3. Condition i2c->msg->flags & 1, taking true branch.
   if (i2c->msg->flags & I2C_M_RD) {

4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL.
   s3c24xx_i2c_stop(i2c, -EINVAL);

5. Jumping to label retry_write.
   goto retry_write;

6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg.
   if (!is_msgend(i2c)) {"

All previous calls to s3c24xx_i2c_stop() in this interrupt service
routine are followed by jumping to end of function (acknowledging
the interrupt and returning).  This seems a reasonable choice also here
since message buffer was entirely emptied.

Addresses-Coverity: Explicit null dereferenced
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
2021-05-28 10:16:23 +02:00
..
algos i2c: algo: bit: use new macro to specifiy capabilities 2021-01-22 09:59:21 +01:00
busses i2c: s3c2410: fix possible NULL pointer deref on read message after write 2021-05-28 10:16:23 +02:00
muxes i2c: muxes: i2c-arb-gpio-challenge: Demote non-conformant kernel-doc headers 2021-05-27 21:29:03 +02:00
i2c-boardinfo.c i2c: Remove support for dangling device properties 2021-04-10 21:43:02 +02:00
i2c-core-acpi.c i2c: core: Do not print duplicate error when failing to register an i2c-client from ACPI 2021-01-05 10:59:11 +01:00
i2c-core-base.c Merge branch 'i2c/for-5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2021-04-30 13:01:02 -07:00
i2c-core-of.c i2c: use my kernel.org address from now on 2020-05-05 16:29:09 +02:00
i2c-core-slave.c i2c: slave: add sanity check when unregistering 2020-07-28 18:37:17 +02:00
i2c-core-smbus.c i2c: smbus: improve naming in i2c_smbus_xfer_emulated() 2021-01-28 10:14:34 +01:00
i2c-core.h i2c: acpi: Remove dead code, i.e. i2c_acpi_match_device() 2020-08-25 09:22:09 +02:00
i2c-dev.c i2c: bail out early when RDWR parameters are wrong 2021-03-18 12:15:29 +01:00
i2c-mux.c i2c: mux: add sysfs header 2019-06-22 07:32:33 +02:00
i2c-slave-eeprom.c i2c: busses: Use fallthrough pseudo-keyword 2020-07-23 22:04:08 +02:00
i2c-slave-testunit.c i2c: testunit: add support for block process calls 2021-02-12 11:11:04 +01:00
i2c-smbus.c i2c: smbus: add core function handling SMBus host-notify 2020-09-09 10:38:28 +02:00
i2c-stub.c i2c: stub: remove definition of DEBUG 2021-01-17 13:00:10 +01:00
Kconfig i2c: add slave testunit driver 2020-09-21 11:02:17 +02:00
Makefile i2c: add slave testunit driver 2020-09-21 11:02:17 +02:00