Re: [PATCH] iio:buffer: Fix NULL pointer deref caused by empty scan mask

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 6/15/2012 2:25 PM, Lars-Peter Clausen wrote:
iio_scan_mask_match() returns NULL if the passed in scan mask is empty. This
will happen if no channel has been selected and buffer is enabled.
iio_sw_buffer_preenable() will assign NULL to indio_dev->active_scan_mask in
this case and as a result iio_update_demux() will cause a NULL pointer deref,
because it expects active_scan_mask to be non-NULL.

Since it does not make much sense to start data capture if there is no data to
capture this patch updates the code to fail gracefully in iio_scan_mask_match()
instead of crashing the kernel.
oops *looks embarassed*.

Signed-off-by: Lars-Peter Clausen<lars@xxxxxxxxxx>
Acked-by: Jonathan Cameron <jic23@xxxxxxxxxx>
---
  drivers/iio/industrialio-buffer.c |    4 ++++
  1 file changed, 4 insertions(+)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index ac185b8..2f35db9 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -553,6 +553,10 @@ int iio_sw_buffer_preenable(struct iio_dev *indio_dev)
  					    buffer->scan_mask);
  	else
  		indio_dev->active_scan_mask = buffer->scan_mask;
+
+	if (indio_dev->active_scan_mask == NULL)
+		return -EINVAL;
+
  	iio_update_demux(indio_dev);

  	if (indio_dev->info->update_scan_mode)

--
To unsubscribe from this list: send the line "unsubscribe linux-iio" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Input]     [Linux Kernel]     [Linux SCSI]     [X.org]

  Powered by Linux