diff options
| author | Ian Abbott <abbotti@mev.co.uk> | 2017-02-17 11:09:08 +0000 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2017-05-17 15:07:00 -0400 |
| commit | 29e34e47fadf0aeea2861e27b6d518e3bba43d51 (patch) | |
| tree | d8a1dd017b87d88f3b3d59d5cbe8efccb738fe1f /drivers/staging | |
| parent | c48408dff998127cf7d7917e98e3bdc1b9548b9b (diff) | |
staging: comedi: jr3_pci: fix possible null pointer dereference
[ Upstream commit 45292be0b3db0b7f8286683b376e2d9f949d11f9 ]
For some reason, the driver does not consider allocation of the
subdevice private data to be a fatal error when attaching the COMEDI
device. It tests the subdevice private data pointer for validity at
certain points, but omits some crucial tests. In particular,
`jr3_pci_auto_attach()` calls `jr3_pci_alloc_spriv()` to allocate and
initialize the subdevice private data, but the same function
subsequently dereferences the pointer to access the `next_time_min` and
`next_time_max` members without checking it first. The other missing
test is in the timer expiry routine `jr3_pci_poll_dev()`, but it will
crash before it gets that far.
Fix the bug by returning `-ENOMEM` from `jr3_pci_auto_attach()` as soon
as one of the calls to `jr3_pci_alloc_spriv()` returns `NULL`. The
COMEDI core will subsequently call `jr3_pci_detach()` to clean up.
Cc: <stable@vger.kernel.org> # 3.15+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Diffstat (limited to 'drivers/staging')
| -rw-r--r-- | drivers/staging/comedi/drivers/jr3_pci.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c index b87192e0f9aa..6c0e9dda571a 100644 --- a/drivers/staging/comedi/drivers/jr3_pci.c +++ b/drivers/staging/comedi/drivers/jr3_pci.c @@ -726,11 +726,12 @@ static int jr3_pci_auto_attach(struct comedi_device *dev, s->insn_read = jr3_pci_ai_insn_read; spriv = jr3_pci_alloc_spriv(dev, s); - if (spriv) { - /* Channel specific range and maxdata */ - s->range_table_list = spriv->range_table_list; - s->maxdata_list = spriv->maxdata_list; - } + if (!spriv) + return -ENOMEM; + + /* Channel specific range and maxdata */ + s->range_table_list = spriv->range_table_list; + s->maxdata_list = spriv->maxdata_list; } /* Reset DSP card */ |