From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65EA1C06510 for ; Tue, 2 Jul 2019 12:34:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3D5DD205F4 for ; Tue, 2 Jul 2019 12:34:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1562070866; bh=XHft2SzCTZ1LYD0fCpddVcCaeJ8vG2bWH91g8vBgd40=; h=Subject:To:From:Date:List-ID:From; b=mzc+ek/hLw37o6l4FzNthwvZFa7sffeYu7S/T4e2RqW3AVSHIVp8MZTC4SBX4Gohu ZLdf3AkRb5o75DQl4iB9rFF3GQi9bwu09Jurwpg95pAIWcHyhlVqPOXKQ6mZSMmcZA BBdhOz2ru0i5SG3B8sWpv1icrXQeupmYK8afGTXY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726821AbfGBMeZ (ORCPT ); Tue, 2 Jul 2019 08:34:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:53674 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726457AbfGBMeZ (ORCPT ); Tue, 2 Jul 2019 08:34:25 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D14EA2054F; Tue, 2 Jul 2019 12:34:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1562070865; bh=XHft2SzCTZ1LYD0fCpddVcCaeJ8vG2bWH91g8vBgd40=; h=Subject:To:From:Date:From; b=2aIc3tcuMKZXxg4Z+DlhgFfqX8rflmRYB5cFN84es/C7oLEWv9qNCzdlXb/if5R0G MDCn9Ug3aOUSKplHXD8roKbyBKU3dnsdRgcZEpsZTgiaCvTUJR9LznwpnjxvGTtf1s dZWbPaGyC36Lm3eET8GMgJjQLmh7Zjs63o6jZBIs= Subject: patch "staging: comedi: amplc_pci230: fix null pointer deref on interrupt" added to staging-next To: abbotti@mev.co.uk, gregkh@linuxfoundation.org, stable@vger.kernel.org From: Date: Tue, 02 Jul 2019 14:29:38 +0200 Message-ID: <1562070578211238@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org This is a note to let you know that I've just added the patch titled staging: comedi: amplc_pci230: fix null pointer deref on interrupt to my staging git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git in the staging-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 7379e6baeddf580d01feca650ec1ad508b6ea8ee Mon Sep 17 00:00:00 2001 From: Ian Abbott Date: Wed, 26 Jun 2019 14:17:39 +0100 Subject: staging: comedi: amplc_pci230: fix null pointer deref on interrupt The interrupt handler `pci230_interrupt()` causes a null pointer dereference for a PCI260 card. There is no analog output subdevice for a PCI260. The `dev->write_subdev` subdevice pointer and therefore the `s_ao` subdevice pointer variable will be `NULL` for a PCI260. The following call near the end of the interrupt handler results in the null pointer dereference for a PCI260: comedi_handle_events(dev, s_ao); Fix it by only calling the above function if `s_ao` is valid. Note that the other uses of `s_ao` in the calls `pci230_handle_ao_nofifo(dev, s_ao);` and `pci230_handle_ao_fifo(dev, s_ao);` will never be reached for a PCI260, so they are safe. Fixes: 39064f23284c ("staging: comedi: amplc_pci230: use comedi_handle_events()") Cc: # v3.19+ Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman --- drivers/staging/comedi/drivers/amplc_pci230.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/amplc_pci230.c b/drivers/staging/comedi/drivers/amplc_pci230.c index 65f60c2b702a..f7e673121864 100644 --- a/drivers/staging/comedi/drivers/amplc_pci230.c +++ b/drivers/staging/comedi/drivers/amplc_pci230.c @@ -2330,7 +2330,8 @@ static irqreturn_t pci230_interrupt(int irq, void *d) devpriv->intr_running = false; spin_unlock_irqrestore(&devpriv->isr_spinlock, irqflags); - comedi_handle_events(dev, s_ao); + if (s_ao) + comedi_handle_events(dev, s_ao); comedi_handle_events(dev, s_ai); return IRQ_HANDLED; -- 2.22.0