]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/commit
staging: comedi: jr3_pci: fix possible null pointer dereference
authorIan Abbott <abbotti@mev.co.uk>
Fri, 17 Feb 2017 11:09:08 +0000 (11:09 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 6 Mar 2017 08:16:58 +0000 (09:16 +0100)
commit45292be0b3db0b7f8286683b376e2d9f949d11f9
tree83de5291f0068c1324276a447b4f8f2ac9064905
parent15c012d5452809c1ff0ac0007b4dd3addef00b63
staging: comedi: jr3_pci: fix possible null pointer dereference

For some reason, the driver does not consider allocation of the
subdevice private data to be a fatal error when attaching the COMEDI
device.  It tests the subdevice private data pointer for validity at
certain points, but omits some crucial tests.  In particular,
`jr3_pci_auto_attach()` calls `jr3_pci_alloc_spriv()` to allocate and
initialize the subdevice private data, but the same function
subsequently dereferences the pointer to access the `next_time_min` and
`next_time_max` members without checking it first.  The other missing
test is in the timer expiry routine `jr3_pci_poll_dev()`, but it will
crash before it gets that far.

Fix the bug by returning `-ENOMEM` from `jr3_pci_auto_attach()` as soon
as one of the calls to `jr3_pci_alloc_spriv()` returns `NULL`.  The
COMEDI core will subsequently call `jr3_pci_detach()` to clean up.

Cc: <stable@vger.kernel.org> # 3.15+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/comedi/drivers/jr3_pci.c