set_ibm_param() could OOPS with a NULL pointer derreference if one did not give
any values for a module parameter it handles. This would, of course, cause all
sort of trouble for future modprobing and require a reboot to clean up
properly.
Fix it by returning -EINVAL if no values are given for the parameter, and also
avoid any nastyness from BUG_ON while at it.
How to reproduce: modprobe thinkpad-acpi brightness
Error report by Mike Kershaw.
Signed-off-by: Henrique de Moraes Holschuh <hmh@xxxxxxxxxx>
Tested-by: Mike Kershaw <dragorn@xxxxxxxxxxxxxxxxxx>
---
drivers/misc/thinkpad_acpi.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
Len,
This one is also needed for 2.6.24-rc. As soon as it hits mainline, I will
also send it to -stable (for 2.6.22.y and 2.6.23.y). It fixes a really,
really annoying OOPS.
Please send it to Linus along with the other patches for 2.6.24-rc.
diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
index 8c94307..ab23a32 100644
--- a/drivers/misc/thinkpad_acpi.c
+++ b/drivers/misc/thinkpad_acpi.c
@@ -4817,9 +4817,15 @@ static int __init set_ibm_param(const char *val, struct kernel_param *kp)
unsigned int i;
struct ibm_struct *ibm;
+ if (!kp || !kp->name || !val)
+ return -EINVAL;
+
for (i = 0; i < ARRAY_SIZE(ibms_init); i++) {
ibm = ibms_init[i].data;
- BUG_ON(ibm == NULL);
+ WARN_ON(ibm == NULL);
+
+ if (!ibm || !ibm->name)
+ continue;
if (strcmp(ibm->name, kp->name) == 0 && ibm->write) {
if (strlen(val) > sizeof(ibms_init[i].param) - 2)
--
1.5.3.4
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
-
To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
