[lvc-project] [PATCH] thunderbolt: handle possible NULL pointer from get_device()

[Greg KH]

On Fri, Jun 09, 2023 at 09:16:19AM +0300, Dmitry Antipov wrote:
> Handle possible NULL pointer returned by 'get_device()'
> in 'tb_xdomain_alloc()' and 'remove_unplugged_switch()'.

Sorry, but how can that happen?

> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
> ---
>  drivers/thunderbolt/icm.c     | 5 +++++
>  drivers/thunderbolt/xdomain.c | 4 ++++
>  2 files changed, 9 insertions(+)
> 
> diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
> index 86521ebb2579..40ab6104a437 100644
> --- a/drivers/thunderbolt/icm.c
> +++ b/drivers/thunderbolt/icm.c
> @@ -2035,6 +2035,11 @@ static void remove_unplugged_switch(struct tb_switch *sw)
>  {
>  	struct device *parent = get_device(sw->dev.parent);
>  
> +	if (!parent) {

This will never fail, how did you test this?


> +		tb_warn(sw->tb, "no parent of switch %pUb\n", sw->uuid);
> +		return;
> +	}
> +
>  	pm_runtime_get_sync(parent);
>  
>  	/*
> diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
> index e2b54887d331..a0ee683d752e 100644
> --- a/drivers/thunderbolt/xdomain.c
> +++ b/drivers/thunderbolt/xdomain.c
> @@ -1883,6 +1883,8 @@ struct tb_xdomain *tb_xdomain_alloc(struct tb *tb, struct device *parent,
>  
>  	device_initialize(&xd->dev);
>  	xd->dev.parent = get_device(parent);
> +	if (!xd->dev.parent)

Again, how did you test this?  How can that ever happen?

thanks,

greg k-h