From: H Hartley Sweeten <hartleys@visionengravers.com>
To: Linux Kernel <linux-kernel@vger.kernel.org>
Cc: <devel@driverdev.osuosl.org>, <abbotti@mev.co.uk>,
<fmhess@users.sourceforge.net>, <gregkh@linuxfoundation.org>
Subject: [PATCH 07/10] staging: comedi: ni_670x: fix dereference of an invalid pointer
Date: Fri, 29 Jun 2012 17:39:45 -0700 [thread overview]
Message-ID: <201206291739.46219.hartleys@visionengravers.com> (raw)
The attach if this driver can fail before the subdevices are
allocated. If the attach fails the comedi core will call the
detach routine to allow the driver to do it's cleanup.
We need to make sure that the subdevice allocation was successful
before trying to dereference subdevice[0] to free the allocated
range table list.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Frank Mori Hess <fmhess@users.sourceforge.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/comedi/drivers/ni_670x.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/drivers/ni_670x.c b/drivers/staging/comedi/drivers/ni_670x.c
index bab9644..46f373a 100644
--- a/drivers/staging/comedi/drivers/ni_670x.c
+++ b/drivers/staging/comedi/drivers/ni_670x.c
@@ -301,8 +301,13 @@ static int ni_670x_attach(struct comedi_device *dev,
static void ni_670x_detach(struct comedi_device *dev)
{
struct ni_670x_private *devpriv = dev->private;
+ struct comedi_subdevice *s;
- kfree(dev->subdevices[0].range_table_list);
+ if (dev->n_subdevices) {
+ s = dev->subdevices + 0;
+ if (s)
+ kfree(s->range_table_list);
+ }
if (devpriv && devpriv->mite)
mite_unsetup(devpriv->mite);
if (dev->irq)
--
1.7.11
reply other threads:[~2012-06-30 0:39 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201206291739.46219.hartleys@visionengravers.com \
--to=hartleys@visionengravers.com \
--cc=abbotti@mev.co.uk \
--cc=devel@driverdev.osuosl.org \
--cc=fmhess@users.sourceforge.net \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®