Re: [PATCH] iio:buffer: Fix NULL pointer deref caused by empty scan mask

[Jonathan Cameron <jic23@cam.ac.uk>]

On 6/15/2012 2:25 PM, Lars-Peter Clausen wrote:
> iio_scan_mask_match() returns NULL if the passed in scan mask is empty. This
> will happen if no channel has been selected and buffer is enabled.
> iio_sw_buffer_preenable() will assign NULL to indio_dev->active_scan_mask in
> this case and as a result iio_update_demux() will cause a NULL pointer deref,
> because it expects active_scan_mask to be non-NULL.
>
> Since it does not make much sense to start data capture if there is no data to
> capture this patch updates the code to fail gracefully in iio_scan_mask_match()
> instead of crashing the kernel.
oops *looks embarassed*.
>
> Signed-off-by: Lars-Peter Clausen<lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
> ---
>   drivers/iio/industrialio-buffer.c |    4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index ac185b8..2f35db9 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -553,6 +553,10 @@ int iio_sw_buffer_preenable(struct iio_dev *indio_dev)
>   					    buffer->scan_mask);
>   	else
>   		indio_dev->active_scan_mask = buffer->scan_mask;
> +
> +	if (indio_dev->active_scan_mask == NULL)
> +		return -EINVAL;
> +
>   	iio_update_demux(indio_dev);
>
>   	if (indio_dev->info->update_scan_mode)