mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-13 14:14:37 +00:00
45292be0b3
For some reason, the driver does not consider allocation of the subdevice private data to be a fatal error when attaching the COMEDI device. It tests the subdevice private data pointer for validity at certain points, but omits some crucial tests. In particular, `jr3_pci_auto_attach()` calls `jr3_pci_alloc_spriv()` to allocate and initialize the subdevice private data, but the same function subsequently dereferences the pointer to access the `next_time_min` and `next_time_max` members without checking it first. The other missing test is in the timer expiry routine `jr3_pci_poll_dev()`, but it will crash before it gets that far. Fix the bug by returning `-ENOMEM` from `jr3_pci_auto_attach()` as soon as one of the calls to `jr3_pci_alloc_spriv()` returns `NULL`. The COMEDI core will subsequently call `jr3_pci_detach()` to clean up. Cc: <stable@vger.kernel.org> # 3.15+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| drivers | ||
| kcomedilib | ||
| comedi.h | ||
| comedi_buf.c | ||
| comedi_compat32.c | ||
| comedi_compat32.h | ||
| comedi_fops.c | ||
| comedi_internal.h | ||
| comedi_pci.c | ||
| comedi_pci.h | ||
| comedi_pcmcia.c | ||
| comedi_pcmcia.h | ||
| comedi_usb.c | ||
| comedi_usb.h | ||
| comedidev.h | ||
| comedilib.h | ||
| drivers.c | ||
| Kconfig | ||
| Makefile | ||
| proc.c | ||
| range.c | ||
| TODO | ||