Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1644499

[PATCH 3.18 08/49] staging: comedi: jr3_pci: fix possible null pointer dereference

Show all headers | View raw

3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ian Abbott <abbotti@mev.co.uk>

commit 45292be0b3db0b7f8286683b376e2d9f949d11f9 upstream.

For some reason, the driver does not consider allocation of the
subdevice private data to be a fatal error when attaching the COMEDI
device.  It tests the subdevice private data pointer for validity at
certain points, but omits some crucial tests.  In particular,
`jr3_pci_auto_attach()` calls `jr3_pci_alloc_spriv()` to allocate and
initialize the subdevice private data, but the same function
subsequently dereferences the pointer to access the `next_time_min` and
`next_time_max` members without checking it first.  The other missing
test is in the timer expiry routine `jr3_pci_poll_dev()`, but it will
crash before it gets that far.

Fix the bug by returning `-ENOMEM` from `jr3_pci_auto_attach()` as soon
as one of the calls to `jr3_pci_alloc_spriv()` returns `NULL`.  The
COMEDI core will subsequently call `jr3_pci_detach()` to clean up.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/comedi/drivers/jr3_pci.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/staging/comedi/drivers/jr3_pci.c
+++ b/drivers/staging/comedi/drivers/jr3_pci.c
@@ -729,11 +729,12 @@ static int jr3_pci_auto_attach(struct co
 		s->insn_read	= jr3_pci_ai_insn_read;
 
 		spriv = jr3_pci_alloc_spriv(dev, s);
-		if (spriv) {
-			/* Channel specific range and maxdata */
-			s->range_table_list	= spriv->range_table_list;
-			s->maxdata_list		= spriv->maxdata_list;
-		}
+		if (!spriv)
+			return -ENOMEM;
+
+		/* Channel specific range and maxdata */
+		s->range_table_list	= spriv->range_table_list;
+		s->maxdata_list		= spriv->maxdata_list;
 	}
 
 	/*  Reset DSP card */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.18 00/49] 3.18.54-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 22/49] SMB3: Work around mount failure when using SMB3 dialect to Macs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 01/49] target/fileio: Fix zero-length READ and WRITE handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 41/49] ppp: defer netns reference release for ppp channel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 09/49] staging: comedi: jr3_pci: cope with jiffies wraparound Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 31/49] perf: Fix event->ctx locking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 11/49] usb: hub: Do not attempt to autosuspend disconnected devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 07/49] staging: gdm724x: gdm_mux: fix use-after-free on module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 44/49] sched: panic on corrupted stack end Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 06/49] staging: vt6656: use off stack for out buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:20 +0200
  [PATCH 3.18 08/49] staging: comedi: jr3_pci: fix possible null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 32/49] arm64: perf: reject groups spanning multiple HW PMUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 42/49] HID: core: prevent out-of-bound readings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 05/49] staging: vt6656: use off stack for in buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 04/49] USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 17/49] IB/mlx4: Fix ib device initialization error flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 39/49] ipv6: sctp: fix lockdep splat in sctp_v6_get_dst() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 33/49] perf: Fix race in swevent hash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 26/49] md/raid1: avoid reusing a resync bio after error handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 38/49] ipv6: sctp: add rcu protection around np->opt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 29/49] Bluetooth: Fix user channel for 32bit userspace on 64bit kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 37/49] sg: Fix double-free when drives detach during SG_IO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 36/49] ext4: fix potential use after free in __ext4_journal_stop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 18/49] fs/xattr.c: zero out memory copied to userspace in getxattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 03/49] USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 34/49] ASN.1: Fix non-match detection failure on data overrun Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 21/49] Set unicode flag on cifs echo request to avoid Mac error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 45/49] ALSA: seq: Fix race at timer setup and close Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 30/49] arm64: make sys_call_table const Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 25/49] padata: free correct variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 28/49] serial: omap: suspend device on probe errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 40/49] af_unix: Guard against other == sk in unix_dgram_sendmsg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:30 +0200
  [PATCH 3.18 02/49] usb: host: xhci: print correct command ring address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 12/49] usb: misc: legousbtower: Fix buffers on stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 20/49] fs/block_dev: always invalidate cleancache in invalidate_bdev() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 16/49] IB/IPoIB: ibX: failed to create mcg debug file Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  [PATCH 3.18 14/49] um: Fix PTRACE_POKEUSER on x86_64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 15:40 +0200
  Re: [PATCH 3.18 00/49] 3.18.54-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-18 19:30 +0200
  Re: [PATCH 3.18 00/49] 3.18.54-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-19 03:10 +0200

csiph-web