Commit c65c64d0 authored by H Hartley Sweeten's avatar H Hartley Sweeten Committed by Greg Kroah-Hartman

staging: comedi: quatech_daqp_cs: fix possible memory dereference issue

In daqp_attach(), the first options value passed in the comedi_devconfig
is used as an index to the private dev_table[] in this driver. This table
is used to pass the pcmcia_device to the comedi_driver.

Fix the code so that the index is checked before the table is accessed
so that we don't get a possible memory dereference BUG.

Change the error returned to the comedi core from -EIO to -ENODEV.
Signed-off-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e23fe9a1
......@@ -733,15 +733,16 @@ static int daqp_do_insn_write(struct comedi_device *dev,
static int daqp_attach(struct comedi_device *dev, struct comedi_devconfig *it)
{
int ret;
struct local_info_t *local = dev_table[it->options[0]];
struct local_info_t *local;
struct comedi_subdevice *s;
int ret;
if (it->options[0] < 0 || it->options[0] >= MAX_DEV || !local) {
dev_err(dev->class_dev, "No such daqp device %d\n",
it->options[0]);
return -EIO;
}
if (it->options[0] < 0 || it->options[0] >= MAX_DEV)
return -ENODEV;
local = dev_table[it->options[0]];
if (!local)
return -ENODEV;
/* Typically brittle code that I don't completely understand,
* but "it works on my card". The intent is to pull the model
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment