[PATCH] uio: uio_dmem_genirq: fix NULL pointer dereference on device tree probe

[zhangjiao2]

From: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>

When the device is probed via device tree (pdev->dev.of_node is set),
dev_get_platdata() returns NULL since no platform data is associated
with device tree probed devices. The driver allocates a new uioinfo
in this path but still dereferences pdata unconditionally to obtain
the number and sizes of dynamic memory regions:

    priv->num_dmem_regions = pdata->num_dynamic_regions;
    for (i = 0; i < pdata->num_dynamic_regions; ++i) {
        ...
        uiomem->size = pdata->dynamic_region_sizes[i];

This causes a NULL pointer dereference crash as soon as device tree
support is enabled by adding compatible entries to the of_match_table.

Guard the pdata access with a NULL check. When pdata is NULL, set
num_dmem_regions to 0 so that the dynamic region setup loop is
skipped entirely. This allows the driver to probe successfully via
device tree with static memory regions and IRQ handling even when no
platform data for dynamic regions is provided.

Signed-off-by: zhang jiao <zhangjiao2@xxxxxxxxxxxxxxxxxxxx>
---
 drivers/uio/uio_dmem_genirq.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
index 41c18ec62a45..4b40e4a5cdb3 100644
--- a/drivers/uio/uio_dmem_genirq.c
+++ b/drivers/uio/uio_dmem_genirq.c
@@ -247,9 +247,9 @@ static int uio_dmem_genirq_probe(struct platform_device *pdev)
 	}
 
 	priv->dmem_region_start = uiomem - &uioinfo->mem[0];
-	priv->num_dmem_regions = pdata->num_dynamic_regions;
+	priv->num_dmem_regions = pdata ? pdata->num_dynamic_regions : 0;
 
-	for (i = 0; i < pdata->num_dynamic_regions; ++i) {
+	for (i = 0; i < priv->num_dmem_regions; ++i) {
 		if (uiomem >= &uioinfo->mem[MAX_UIO_MAPS]) {
 			dev_warn(&pdev->dev, "device has more than "
 					__stringify(MAX_UIO_MAPS)
-- 
2.33.0