lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 28 Jul 2010 11:50:36 -0500 From: Ernesto Ramos <ernesto@...com> To: gregkh@...e.de Cc: omar.ramirez@...com, ohad@...ery.com, ameya.palande@...ia.com, felipe.contreras@...ia.com, fernando.lugo@...com, linux-kernel@...r.kernel.org, andy.shevchenko@...il.com, nm@...com, linux-omap@...r.kernel.org, Ernesto Ramos <ernesto@...com> Subject: [PATCH] staging:ti dspbridge: avoid possible NULL dereference panic When dsp_notifications array is received from user, dspbridge verifies the array has valid pointers and dsp_notification structures. However, these structures contain pointers that need to be checked for valid handles. Signed-off-by: Ernesto Ramos <ernesto@...com> --- drivers/staging/tidspbridge/pmgr/dspapi.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/staging/tidspbridge/pmgr/dspapi.c b/drivers/staging/tidspbridge/pmgr/dspapi.c index 1b0ab4a..da08dfc 100644 --- a/drivers/staging/tidspbridge/pmgr/dspapi.c +++ b/drivers/staging/tidspbridge/pmgr/dspapi.c @@ -539,7 +539,7 @@ func_end: */ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) { - int status = 0, real_status = 0; + int status = 0; struct dsp_notification *anotifications[MAX_EVENTS]; struct dsp_notification notifications[MAX_EVENTS]; u32 index, i; @@ -554,19 +554,21 @@ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) /* get the events */ for (i = 0; i < count; i++) { CP_FM_USR(¬ifications[i], anotifications[i], status, 1); - if (!status) { - /* set the array of pointers to kernel structures */ - anotifications[i] = ¬ifications[i]; + if (status || !notifications[i].handle) { + status = -EINVAL; + break; } + /* set the array of pointers to kernel structures */ + anotifications[i] = ¬ifications[i]; } if (!status) { - real_status = mgr_wait_for_bridge_events(anotifications, count, + status = mgr_wait_for_bridge_events(anotifications, count, &index, args->args_mgr_wait. utimeout); } CP_TO_USR(args->args_mgr_wait.pu_index, &index, status, 1); - return real_status; + return status; } /* -- 1.5.4.5 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists