malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-03-24 12:17:26 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

staging: comedi: jr3_pci: fix possible null pointer dereference

Browse Source 
For some reason, the driver does not consider allocation of the
subdevice private data to be a fatal error when attaching the COMEDI
device.  It tests the subdevice private data pointer for validity at
certain points, but omits some crucial tests.  In particular,
`jr3_pci_auto_attach()` calls `jr3_pci_alloc_spriv()` to allocate and
initialize the subdevice private data, but the same function
subsequently dereferences the pointer to access the `next_time_min` and
`next_time_max` members without checking it first.  The other missing
test is in the timer expiry routine `jr3_pci_poll_dev()`, but it will
crash before it gets that far.

Fix the bug by returning `-ENOMEM` from `jr3_pci_auto_attach()` as soon
as one of the calls to `jr3_pci_alloc_spriv()` returns `NULL`.  The
COMEDI core will subsequently call `jr3_pci_detach()` to clean up.

Cc: <stable@vger.kernel.org> # 3.15+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ian Abbott 2017-02-17 11:09:08 +00:00 committed by Greg Kroah-Hartman
parent 15c012d545
commit 45292be0b3
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/staging/comedi/drivers/jr3_pci.c
View File

@ -727,11 +727,12 @@ static int jr3_pci_auto_attach(struct comedi_device *dev,
s->insn_read = jr3_pci_ai_insn_read;
spriv = jr3_pci_alloc_spriv(dev, s);
if (spriv) {
/* Channel specific range and maxdata */
s->range_table_list = spriv->range_table_list;
s->maxdata_list = spriv->maxdata_list;
}
if (!spriv)
return -ENOMEM;
/* Channel specific range and maxdata */
s->range_table_list = spriv->range_table_list;
s->maxdata_list = spriv->maxdata_list;
}
/* Reset DSP card */