From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Ian Abbott <abbotti@mev.co.uk>
Subject: [ 30/30] staging: comedi: check s->async for poll(), read() and write()
Date: Fri, 1 Mar 2013 11:45:51 -0800 [thread overview]
Message-ID: <20130301194531.268432010@linuxfoundation.org> (raw)
In-Reply-To: <20130301194527.988540148@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <abbotti@mev.co.uk>
commit cc400e185c07c15a42d2635995f422de5b94b696 upstream.
Some low-level comedi drivers (incorrectly) point `dev->read_subdev` or
`dev->write_subdev` to a subdevice that does not support asynchronous
commands. Comedi's poll(), read() and write() file operation handlers
assume these subdevices do support asynchronous commands. In
particular, they assume `s->async` is valid (where `s` points to the
read or write subdevice), which it won't be if it has been set
incorrectly. This can lead to a NULL pointer dereference.
Check `s->async` is non-NULL in `comedi_poll()`, `comedi_read()` and
`comedi_write()` to avoid the bug.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/comedi_fops.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1577,7 +1577,7 @@ static unsigned int comedi_poll(struct f
mask = 0;
read_subdev = comedi_get_read_subdevice(dev_file_info);
- if (read_subdev) {
+ if (read_subdev && read_subdev->async) {
poll_wait(file, &read_subdev->async->wait_head, wait);
if (!read_subdev->busy
|| comedi_buf_read_n_available(read_subdev->async) > 0
@@ -1587,7 +1587,7 @@ static unsigned int comedi_poll(struct f
}
}
write_subdev = comedi_get_write_subdevice(dev_file_info);
- if (write_subdev) {
+ if (write_subdev && write_subdev->async) {
poll_wait(file, &write_subdev->async->wait_head, wait);
comedi_buf_write_alloc(write_subdev->async,
write_subdev->async->prealloc_bufsz);
@@ -1629,7 +1629,7 @@ static ssize_t comedi_write(struct file
}
s = comedi_get_write_subdevice(dev_file_info);
- if (s == NULL) {
+ if (s == NULL || s->async == NULL) {
retval = -EIO;
goto done;
}
@@ -1740,7 +1740,7 @@ static ssize_t comedi_read(struct file *
}
s = comedi_get_read_subdevice(dev_file_info);
- if (s == NULL) {
+ if (s == NULL || s->async == NULL) {
retval = -EIO;
goto done;
}
next prev parent reply other threads:[~2013-03-01 19:47 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-01 19:45 [ 00/30] 3.0.68-stable review Greg Kroah-Hartman
2013-03-01 19:45 ` [ 01/30] quota: autoload the quota_v2 module for QFMT_VFS_V1 quota format Greg Kroah-Hartman
2013-03-01 19:45 ` [ 02/30] iommu/amd: Initialize device table after dma_ops Greg Kroah-Hartman
2013-03-01 19:45 ` [ 03/30] posix-timer: Dont call idr_find() with out-of-range ID Greg Kroah-Hartman
2013-03-01 19:45 ` [ 04/30] ftrace: Call ftrace cleanup module notifier after all other notifiers Greg Kroah-Hartman
2013-03-01 19:45 ` [ 05/30] doc, xen: Mention earlyprintk=xen in the documentation Greg Kroah-Hartman
2013-03-01 19:45 ` [ 06/30] doc, kernel-parameters: Document console=hvc<n> Greg Kroah-Hartman
2013-03-01 19:45 ` [ 07/30] x86: Make sure we can boot in the case the BDA contains pure garbage Greg Kroah-Hartman
2013-03-01 19:45 ` [ 08/30] target: Add missing mapped_lun bounds checking during make_mappedlun setup Greg Kroah-Hartman
2013-03-01 19:45 ` [ 09/30] ocfs2: ac->ac_allow_chain_relink=0 wont disable group relink Greg Kroah-Hartman
2013-03-01 19:45 ` [ 10/30] xen-blkback: do not leak mode property Greg Kroah-Hartman
2013-03-01 19:45 ` [ 11/30] idr: fix a subtle bug in idr_get_next() Greg Kroah-Hartman
2013-03-01 19:45 ` [ 12/30] firewire: add minor number range check to fw_device_init() Greg Kroah-Hartman
2013-03-01 19:45 ` [ 13/30] sysctl: fix null checking in bin_dn_node_address() Greg Kroah-Hartman
2013-03-01 19:45 ` [ 14/30] media: rc: unlock on error in show_protocols() Greg Kroah-Hartman
2013-03-01 19:45 ` [ 15/30] ext4: fix race in ext4_mb_add_n_trim() Greg Kroah-Hartman
2013-03-01 19:45 ` [ 16/30] svcrpc: make svc_age_temp_xprts enqueue under sv_lock Greg Kroah-Hartman
2013-03-01 19:45 ` [ 17/30] vhost: fix length for cross region descriptor Greg Kroah-Hartman
2013-03-01 19:45 ` [ 18/30] ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up() Greg Kroah-Hartman
2013-03-01 19:45 ` [ 19/30] ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL Greg Kroah-Hartman
2013-03-01 19:45 ` [ 20/30] wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task Greg Kroah-Hartman
2013-03-01 19:45 ` [ 21/30] unbreak automounter support on 64-bit kernel with 32-bit userspace (v2) Greg Kroah-Hartman
2013-03-01 19:45 ` [ 22/30] x86: Do not leak kernel page mapping locations Greg Kroah-Hartman
2013-03-01 19:45 ` [ 23/30] x86/apic: Work around boot failure on HP ProLiant DL980 G7 Server systems Greg Kroah-Hartman
2013-03-01 19:45 ` [ 24/30] cpuset: fix cpuset_print_task_mems_allowed() vs rename() race Greg Kroah-Hartman
2013-03-01 19:45 ` [ 25/30] cgroup: fix exit() vs rmdir() race Greg Kroah-Hartman
2013-03-01 19:45 ` [ 26/30] dca: check against empty dca_domains list before unregister provider fix Greg Kroah-Hartman
2013-03-01 19:45 ` [ 27/30] s390/kvm: Fix store status for ACRS/FPRS fix Greg Kroah-Hartman
2013-03-01 19:45 ` [ 28/30] staging: comedi: ni_labpc: correct differential channel sequence for AI commands Greg Kroah-Hartman
2013-03-01 19:45 ` [ 29/30] staging: comedi: ni_labpc: set up command4 register *after* command3 Greg Kroah-Hartman
2013-03-01 19:45 ` Greg Kroah-Hartman [this message]
2013-03-02 3:58 ` [ 00/30] 3.0.68-stable review Shuah Khan
2013-03-03 11:47 ` Satoru Takeuchi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130301194531.268432010@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=abbotti@mev.co.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox