Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1644381

[PATCH 4.10 14/93] staging: comedi: jr3_pci: fix possible null pointer dereference

Show all headers | View raw

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Abbott <abbotti@mev.co.uk>

commit 45292be0b3db0b7f8286683b376e2d9f949d11f9 upstream.

For some reason, the driver does not consider allocation of the
subdevice private data to be a fatal error when attaching the COMEDI
device.  It tests the subdevice private data pointer for validity at
certain points, but omits some crucial tests.  In particular,
`jr3_pci_auto_attach()` calls `jr3_pci_alloc_spriv()` to allocate and
initialize the subdevice private data, but the same function
subsequently dereferences the pointer to access the `next_time_min` and
`next_time_max` members without checking it first.  The other missing
test is in the timer expiry routine `jr3_pci_poll_dev()`, but it will
crash before it gets that far.

Fix the bug by returning `-ENOMEM` from `jr3_pci_auto_attach()` as soon
as one of the calls to `jr3_pci_alloc_spriv()` returns `NULL`.  The
COMEDI core will subsequently call `jr3_pci_detach()` to clean up.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/jr3_pci.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/staging/comedi/drivers/jr3_pci.c
+++ b/drivers/staging/comedi/drivers/jr3_pci.c
@@ -727,11 +727,12 @@ static int jr3_pci_auto_attach(struct co
 		s->insn_read	= jr3_pci_ai_insn_read;
 
 		spriv = jr3_pci_alloc_spriv(dev, s);
-		if (spriv) {
-			/* Channel specific range and maxdata */
-			s->range_table_list	= spriv->range_table_list;
-			s->maxdata_list		= spriv->maxdata_list;
-		}
+		if (!spriv)
+			return -ENOMEM;
+
+		/* Channel specific range and maxdata */
+		s->range_table_list	= spriv->range_table_list;
+		s->maxdata_list		= spriv->maxdata_list;
 	}
 
 	/* Reset DSP card */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.10 00/93] 4.10.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 22/93] x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 34/93] crypto: ccp - Disable interrupts early on unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 30/93] block: fix blk_integrity_register to use templates interval_exp if not 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 03/93] target/fileio: Fix zero-length READ and WRITE handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 54/93] orangefs: fix bounds check for listxattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 62/93] Fix match_prepath() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 21/93] usb: misc: legousbtower: Fix buffers on stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 56/93] orangefs: do not set getattr_time on orangefs_lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 57/93] orangefs: do not check possibly stale size on truncate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 02/93] target: Fix compare_and_write_callback handling for non GOOD status Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 07/93] USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 08/93] USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 59/93] ceph: fix memory leak in __ceph_setxattr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 43/93] IB/core: Fix sysfs registration error flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 26/93] perf/x86: Fix Broadwell-EP DRAM RAPL events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 44/93] IB/core: For multicast functions, verify that LIDs are multicast LIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
  [PATCH 4.10 11/93] staging: vt6656: use off stack for out buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
  [PATCH 4.10 18/93] usb: Make sure usb/phy/of gets built-in Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
  [PATCH 4.10 01/93] xen: adjust early dom0 p2m handling to xen hypervisor behavior Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
  [PATCH 4.10 12/93] staging: gdm724x: gdm_mux: fix use-after-free on module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
  [PATCH 4.10 14/93] staging: comedi: jr3_pci: fix possible null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
  Re: [PATCH 4.10 00/93] 4.10.17-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-18 19:40 +0200
  Re: [PATCH 4.10 00/93] 4.10.17-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-19 03:20 +0200

csiph-web