diff options
| author |   Ernesto Ramos <ernesto@ti.com> | 2010-07-28 11:50:36 -0500 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@suse.de> | 2010-08-02 17:11:00 -0700 |
| commit | 35f338e4f2fcd2614f6fdff33f38920cf9434f86 (patch) | |
| tree | 4f2a513c4861a32e510f47f56905a91f3b5de933 /drivers/staging/tidspbridge | |
| parent | staging: iio: ring_sw Fix pointer arithmetic for 64bit arches by using phys_addr_t (diff) | |
| download | linux-dev-35f338e4f2fcd2614f6fdff33f38920cf9434f86.tar.xz linux-dev-35f338e4f2fcd2614f6fdff33f38920cf9434f86.zip | |
staging: ti dspbridge: avoid possible NULL dereference panic
When dsp_notifications array is received from user,
dspbridge verifies the array has valid pointers
and dsp_notification structures. However, these
structures contain pointers that need to be
checked for valid handles.
Signed-off-by: Ernesto Ramos <ernesto@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/staging/tidspbridge')
| -rw-r--r-- | drivers/staging/tidspbridge/pmgr/dspapi.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/drivers/staging/tidspbridge/pmgr/dspapi.c b/drivers/staging/tidspbridge/pmgr/dspapi.c index 1b0ab4ab1921..da08dfc64593 100644 --- a/drivers/staging/tidspbridge/pmgr/dspapi.c +++ b/drivers/staging/tidspbridge/pmgr/dspapi.c @@ -539,7 +539,7 @@ func_end: */ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) { - int status = 0, real_status = 0; + int status = 0; struct dsp_notification *anotifications[MAX_EVENTS]; struct dsp_notification notifications[MAX_EVENTS]; u32 index, i; @@ -554,19 +554,21 @@ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) /* get the events */ for (i = 0; i < count; i++) { CP_FM_USR(¬ifications[i], anotifications[i], status, 1); - if (!status) { - /* set the array of pointers to kernel structures */ - anotifications[i] = ¬ifications[i]; + if (status || !notifications[i].handle) { + status = -EINVAL; + break; } + /* set the array of pointers to kernel structures */ + anotifications[i] = ¬ifications[i]; } if (!status) { - real_status = mgr_wait_for_bridge_events(anotifications, count, + status = mgr_wait_for_bridge_events(anotifications, count, &index, args->args_mgr_wait. utimeout); } CP_TO_USR(args->args_mgr_wait.pu_index, &index, status, 1); - return real_status; + return status; } /* |