Skip to content

Commit 207d216

Browse files
authored
ingenic: check the fopen before writing the sensor clock enable (#209)
ingenic_enable_sensor_clock() opened /proc/jz/clock/cgu_cim/enable for writing and passed the result straight to fprintf() without looking at it. The node is 0600 and the open can fail -- not running as root, or a kernel that does not offer it for writing -- so the result was a null dereference where the honest outcome is a probe that finds no sensor. Reachable for as long as the function has existed, and more so since 449ce2c made the probe path re-arm the sensor clock before every attempt rather than once per run: the same null is now reached up to seven times per invocation. Not demonstrated on hardware. The lab T31L reads `enabled` from that node, so the branch holding the fopen is not taken there, and engineering a failure would mean gating the sensor clock off underneath a running streamer. Verified on it that detection is unchanged: SC2332 on bus 0, before and after. Found while verifying 449ce2c's sensor-bus fix on that board, which also confirmed the Ingenic half of it: with /dev/i2c-3 pointing at adapter 0 and /dev/i2c-0 moved aside, the released build reports no sensor and current master reports SC2332 on bus 3 -- exercising both the gap-tolerant sweep and ingenic_open_i2c_fd() honouring its adapter argument, which it previously ignored.
1 parent 449ce2c commit 207d216

1 file changed

Lines changed: 8 additions & 0 deletions

File tree

src/hal/ingenic.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -352,6 +352,14 @@ static void ingenic_enable_sensor_clock() {
352352
sizeof(buf))) {
353353
if (!strcmp(buf, "disabled")) {
354354
f = fopen("/proc/jz/clock/cgu_cim/enable", "w");
355+
/* The file is readable at 0600 and we may not be root, or the
356+
* kernel may not offer it for writing at all. Unchecked, this was
357+
* a null fprintf() -- a segfault where the honest outcome is a
358+
* probe that finds no sensor. It matters more since the probe path
359+
* began re-arming the clock before every attempt rather than once
360+
* per run: the same null is now reached up to seven times. */
361+
if (!f)
362+
return;
355363
fprintf(f, "%s", "1");
356364
uint32_t direct;
357365
mem_reg(0x10010030, &direct, OP_READ);

0 commit comments

Comments
 (0)