From 35f338e4f2fcd2614f6fdff33f38920cf9434f86 Mon Sep 17 00:00:00 2001 From: Ernesto Ramos Date: Wed, 28 Jul 2010 11:50:36 -0500 Subject: staging: ti dspbridge: avoid possible NULL dereference panic When dsp_notifications array is received from user, dspbridge verifies the array has valid pointers and dsp_notification structures. However, these structures contain pointers that need to be checked for valid handles. Signed-off-by: Ernesto Ramos Signed-off-by: Greg Kroah-Hartman --- drivers/staging/tidspbridge/pmgr/dspapi.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'drivers/staging/tidspbridge') diff --git a/drivers/staging/tidspbridge/pmgr/dspapi.c b/drivers/staging/tidspbridge/pmgr/dspapi.c index 1b0ab4ab1921..da08dfc64593 100644 --- a/drivers/staging/tidspbridge/pmgr/dspapi.c +++ b/drivers/staging/tidspbridge/pmgr/dspapi.c @@ -539,7 +539,7 @@ func_end: */ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) { - int status = 0, real_status = 0; + int status = 0; struct dsp_notification *anotifications[MAX_EVENTS]; struct dsp_notification notifications[MAX_EVENTS]; u32 index, i; @@ -554,19 +554,21 @@ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) /* get the events */ for (i = 0; i < count; i++) { CP_FM_USR(¬ifications[i], anotifications[i], status, 1); - if (!status) { - /* set the array of pointers to kernel structures */ - anotifications[i] = ¬ifications[i]; + if (status || !notifications[i].handle) { + status = -EINVAL; + break; } + /* set the array of pointers to kernel structures */ + anotifications[i] = ¬ifications[i]; } if (!status) { - real_status = mgr_wait_for_bridge_events(anotifications, count, + status = mgr_wait_for_bridge_events(anotifications, count, &index, args->args_mgr_wait. utimeout); } CP_TO_USR(args->args_mgr_wait.pu_index, &index, status, 1); - return real_status; + return status; } /* -- cgit v1.2.3-59-g8ed1b