linux-kernel - [PATCH] staging:ti dspbridge: avoid possible NULL dereference panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1280335836-31801-1-git-send-email-ernesto@ti.com>
Date:	Wed, 28 Jul 2010 11:50:36 -0500
From:	Ernesto Ramos <ernesto@...com>
To:	gregkh@...e.de
Cc:	omar.ramirez@...com, ohad@...ery.com, ameya.palande@...ia.com,
	felipe.contreras@...ia.com, fernando.lugo@...com,
	linux-kernel@...r.kernel.org, andy.shevchenko@...il.com, nm@...com,
	linux-omap@...r.kernel.org, Ernesto Ramos <ernesto@...com>
Subject: [PATCH] staging:ti dspbridge: avoid possible NULL dereference panic

When dsp_notifications array is received from user,
dspbridge verifies the array has valid pointers
and dsp_notification structures. However, these
structures contain pointers that need to be
checked for valid handles.

Signed-off-by: Ernesto Ramos <ernesto@...com>
---
 drivers/staging/tidspbridge/pmgr/dspapi.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/tidspbridge/pmgr/dspapi.c b/drivers/staging/tidspbridge/pmgr/dspapi.c
index 1b0ab4a..da08dfc 100644
--- a/drivers/staging/tidspbridge/pmgr/dspapi.c
+++ b/drivers/staging/tidspbridge/pmgr/dspapi.c
@@ -539,7 +539,7 @@ func_end:
  */
 u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt)
 {
-	int status = 0, real_status = 0;
+	int status = 0;
 	struct dsp_notification *anotifications[MAX_EVENTS];
 	struct dsp_notification notifications[MAX_EVENTS];
 	u32 index, i;
@@ -554,19 +554,21 @@ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt)
 	/* get the events */
 	for (i = 0; i < count; i++) {
 		CP_FM_USR(&notifications[i], anotifications[i], status, 1);
-		if (!status) {
-			/* set the array of pointers to kernel structures */
-			anotifications[i] = &notifications[i];
+		if (status || !notifications[i].handle) {
+			status = -EINVAL;
+			break;
 		}
+		/* set the array of pointers to kernel structures */
+		anotifications[i] = &notifications[i];
 	}
 	if (!status) {
-		real_status = mgr_wait_for_bridge_events(anotifications, count,
+		status = mgr_wait_for_bridge_events(anotifications, count,
 							 &index,
 							 args->args_mgr_wait.
 							 utimeout);
 	}
 	CP_TO_USR(args->args_mgr_wait.pu_index, &index, status, 1);
-	return real_status;
+	return status;
 }
 
 /*
-- 
1.5.4.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/