| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 16 Aug 2008 19:17:05 -0400
From: "Parag Warudkar" <parag.warudkar@...il.com>
To: mjg59@...f.ucam.org
Cc: "Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/2] Add Dell laptop driver
Matthew Garrett <mjg59 <at> srcf.ucam.org> writes:
> diff --git a/drivers/misc/dell-laptop.c b/drivers/misc/dell-laptop.c
> new file mode 100644
> index 0000000..ab09a69
> --- /dev/null
> +++ b/drivers/misc/dell-laptop.c
[Snip]
> + da_command_address = table->cmdIOAddress;
> + da_command_code = table->cmdIOCode;
> +
> + da_tokens = krealloc(da_tokens, (da_num_tokens + tokens) *
> + sizeof(struct calling_interface_token),
> + GFP_KERNEL);
Isn't a NULL check required here?
> +
> + memcpy(da_tokens+da_num_tokens, table->tokens,
> + sizeof(struct calling_interface_token) * tokens);
> +
> +static struct calling_interface_buffer *dell_send_request(
> + struct calling_interface_buffer *buffer, int class, int select)
> +{
> + struct smi_cmd *command = kzalloc(sizeof(struct smi_cmd), GFP_KERNEL);
NULL check - Here too.
> + command->magic = SMI_CMD_MAGIC;
> + command->command_address = da_command_address;
> + command->command_code = da_command_code;
> + command->ebx = virt_to_phys(buffer);
> + command->ecx = 0x42534931;
> +
> +
> +static int dell_rfkill_set(int radio, enum rfkill_state state)
> +{
> + struct calling_interface_buffer *buffer =
> + kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
Ditto.
> + int disable = (state == RFKILL_STATE_UNBLOCKED) ? 0 : 1;
> + buffer->input[0] = (1 | (radio<<8) | (disable << 16));
> + dell_send_request(buffer, 17, 11);
> + kfree(buffer);
> + return 0;
> +}
> +static int dell_rfkill_get(int bit, enum rfkill_state *state)
> +{
> + struct calling_interface_buffer *buffer =
> + kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
This makes me confident there is code in the kernel that always
succeeds allocations by mjg59.
Just got to find where it's hidden :)
> +static int dell_wifi_get(void *data, enum rfkill_state *state)
> +{
> + return dell_rfkill_get(17, state);
> +}
> +
> +static int dell_bluetooth_get(void *data, enum rfkill_state *state)
> +{
> + return dell_rfkill_get(18, state);
> +}
> +
> +static int dell_wwan_get(void *data, enum rfkill_state *state)
> +{
> + return dell_rfkill_get(19, state);
> +}
> +
> +static void dell_setup_rfkill(void)
> +{
> + struct calling_interface_buffer *buffer =
> + kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
Once more.
> +
> +static int dell_send_intensity(struct backlight_device *bd)
> +{
> + int intensity = bd->props.brightness;
> + struct calling_interface_buffer *buffer =
> + kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
Stopped counting!
> +
> + buffer->input[0] = find_token_location(0x7d);
> + buffer->input[1] = intensity;
> +
> + if (buffer->input[0] == -1) {
> + kfree(buffer);
> + return -ENODEV;
> + }
> +
> +static int dell_get_intensity(struct backlight_device *bd)
> +{
> + struct calling_interface_buffer *buffer =
> + kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
count_prev++;
> + if (!dmi_check_system(dell_device_table))
> + return -ENODEV;
> +
> + dmi_walk(find_tokens);
> +
> + if (!da_tokens)
> + return -ENODEV;
> +
> + buffer = kzalloc(sizeof(struct calling_interface_buffer), GFP_KERNEL);
One last.
> + buffer->input[0] = find_token_location(0x7d);
> +
> + if (buffer->input[0] != -1) {
> + dell_send_request(buffer, 2, 1);
> + max_intensity = buffer->output[3];
> + }
> +
Parag
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists