Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c65c64d0 authored by H Hartley Sweeten's avatar H Hartley Sweeten Committed by Greg Kroah-Hartman
Browse files

staging: comedi: quatech_daqp_cs: fix possible memory dereference issue 



In daqp_attach(), the first options value passed in the comedi_devconfig
is used as an index to the private dev_table[] in this driver. This table
is used to pass the pcmcia_device to the comedi_driver.

Fix the code so that the index is checked before the table is accessed
so that we don't get a possible memory dereference BUG.

Change the error returned to the comedi core from -EIO to -ENODEV.

Signed-off-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e23fe9a1

drivers/staging/comedi/drivers/quatech_daqp_cs.c

+8 −7
Original line number Diff line number Diff line
@@ -733,15 +733,16 @@ static int daqp_do_insn_write(struct comedi_device *dev, 


static int daqp_attach(struct comedi_device *dev, struct comedi_devconfig *it)

{

	int ret;

	struct local_info_t *local = dev_table[it->options[0]];

	struct local_info_t *local;

	struct comedi_subdevice *s;

	int ret;



	if (it->options[0] < 0 || it->options[0] >= MAX_DEV || !local) {

		dev_err(dev->class_dev, "No such daqp device %d\n",

			it->options[0]);

		return -EIO;

	}

	if (it->options[0] < 0 || it->options[0] >= MAX_DEV)

		return -ENODEV;



	local = dev_table[it->options[0]];

	if (!local)

		return -ENODEV;



	/* Typically brittle code that I don't completely understand,

	 * but "it works on my card".  The intent is to pull the model