* [PATCH] iio:buffer: Fix NULL pointer deref caused by empty scan mask
@ 2012-06-15 13:25 Lars-Peter Clausen
2012-06-15 13:33 ` Jonathan Cameron
0 siblings, 1 reply; 3+ messages in thread
From: Lars-Peter Clausen @ 2012-06-15 13:25 UTC (permalink / raw)
To: Jonathan Cameron; +Cc: linux-iio, Lars-Peter Clausen
iio_scan_mask_match() returns NULL if the passed in scan mask is empty. This
will happen if no channel has been selected and buffer is enabled.
iio_sw_buffer_preenable() will assign NULL to indio_dev->active_scan_mask in
this case and as a result iio_update_demux() will cause a NULL pointer deref,
because it expects active_scan_mask to be non-NULL.
Since it does not make much sense to start data capture if there is no data to
capture this patch updates the code to fail gracefully in iio_scan_mask_match()
instead of crashing the kernel.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
---
drivers/iio/industrialio-buffer.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index ac185b8..2f35db9 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -553,6 +553,10 @@ int iio_sw_buffer_preenable(struct iio_dev *indio_dev)
buffer->scan_mask);
else
indio_dev->active_scan_mask = buffer->scan_mask;
+
+ if (indio_dev->active_scan_mask == NULL)
+ return -EINVAL;
+
iio_update_demux(indio_dev);
if (indio_dev->info->update_scan_mode)
--
1.7.10
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] iio:buffer: Fix NULL pointer deref caused by empty scan mask
2012-06-15 13:25 Lars-Peter Clausen
@ 2012-06-15 13:33 ` Jonathan Cameron
0 siblings, 0 replies; 3+ messages in thread
From: Jonathan Cameron @ 2012-06-15 13:33 UTC (permalink / raw)
To: Lars-Peter Clausen; +Cc: linux-iio
On 6/15/2012 2:25 PM, Lars-Peter Clausen wrote:
> iio_scan_mask_match() returns NULL if the passed in scan mask is empty. This
> will happen if no channel has been selected and buffer is enabled.
> iio_sw_buffer_preenable() will assign NULL to indio_dev->active_scan_mask in
> this case and as a result iio_update_demux() will cause a NULL pointer deref,
> because it expects active_scan_mask to be non-NULL.
>
> Since it does not make much sense to start data capture if there is no data to
> capture this patch updates the code to fail gracefully in iio_scan_mask_match()
> instead of crashing the kernel.
oops *looks embarassed*.
>
> Signed-off-by: Lars-Peter Clausen<lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
> ---
> drivers/iio/industrialio-buffer.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index ac185b8..2f35db9 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -553,6 +553,10 @@ int iio_sw_buffer_preenable(struct iio_dev *indio_dev)
> buffer->scan_mask);
> else
> indio_dev->active_scan_mask = buffer->scan_mask;
> +
> + if (indio_dev->active_scan_mask == NULL)
> + return -EINVAL;
> +
> iio_update_demux(indio_dev);
>
> if (indio_dev->info->update_scan_mode)
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] iio:buffer: Fix NULL pointer deref caused by empty scan mask
@ 2012-06-15 16:08 Lars-Peter Clausen
0 siblings, 0 replies; 3+ messages in thread
From: Lars-Peter Clausen @ 2012-06-15 16:08 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: Jonathan Cameron, devel, linux-iio, Lars-Peter Clausen
iio_scan_mask_match() returns NULL if the passed in scan mask is empty. This
will happen if no channel has been selected and buffer is enabled.
iio_sw_buffer_preenable() will assign NULL to indio_dev->active_scan_mask in
this case. As a result iio_update_demux() will cause a NULL pointer deref,
because it expects active_scan_mask to be non-NULL.
Since it does not make much sense to start data capture if there is no data to
capture this patch updates the code to fail gracefully in iio_scan_mask_match()
instead of crashing the kernel.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
---
drivers/iio/industrialio-buffer.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index ac185b8..2f35db9 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -553,6 +553,10 @@ int iio_sw_buffer_preenable(struct iio_dev *indio_dev)
buffer->scan_mask);
else
indio_dev->active_scan_mask = buffer->scan_mask;
+
+ if (indio_dev->active_scan_mask == NULL)
+ return -EINVAL;
+
iio_update_demux(indio_dev);
if (indio_dev->info->update_scan_mode)
--
1.7.10
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-06-15 16:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-06-15 16:08 [PATCH] iio:buffer: Fix NULL pointer deref caused by empty scan mask Lars-Peter Clausen
-- strict thread matches above, loose matches on Subject: below --
2012-06-15 13:25 Lars-Peter Clausen
2012-06-15 13:33 ` Jonathan Cameron
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).