lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <1443864298-20950-1-git-send-email-sudipm.mukherjee@gmail.com> Date: Sat, 3 Oct 2015 14:54:56 +0530 From: Sudip Mukherjee <sudipm.mukherjee@...il.com> To: Dmitry Torokhov <dmitry.torokhov@...il.com> Cc: linux-kernel@...r.kernel.org, linux-input@...r.kernel.org, Sudip Mukherjee <sudipm.mukherjee@...il.com> Subject: [PATCH v2 1/3] Input: db9 - store object at correct index The variable i is used to check the port to attach to and we are supposed to save the reference of struct db9 in the location given by db9_base[i]. But after finding out the index, i is getting modified again so we saved in a wrong index. While at it mark db9_base[i] as NULL after it is freed. Fixes: 2260c419b52b ("Input: db9 - use parallel port device model") Signed-off-by: Sudip Mukherjee <sudip@...torindia.org> --- drivers/input/joystick/db9.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/input/joystick/db9.c b/drivers/input/joystick/db9.c index cf1f602..932d073 100644 --- a/drivers/input/joystick/db9.c +++ b/drivers/input/joystick/db9.c @@ -560,25 +560,25 @@ static void db9_attach(struct parport *pp) const struct db9_mode_data *db9_mode; struct pardevice *pd; struct input_dev *input_dev; - int i, j; + int i, j, port_idx; int mode; struct pardev_cb db9_parport_cb; - for (i = 0; i < DB9_MAX_PORTS; i++) { - if (db9_cfg[i].nargs == 0 || - db9_cfg[i].args[DB9_ARG_PARPORT] < 0) + for (port_idx = 0; port_idx < DB9_MAX_PORTS; port_idx++) { + if (db9_cfg[port_idx].nargs == 0 || + db9_cfg[port_idx].args[DB9_ARG_PARPORT] < 0) continue; - if (db9_cfg[i].args[DB9_ARG_PARPORT] == pp->number) + if (db9_cfg[port_idx].args[DB9_ARG_PARPORT] == pp->number) break; } - if (i == DB9_MAX_PORTS) { + if (port_idx == DB9_MAX_PORTS) { pr_debug("Not using parport%d.\n", pp->number); return; } - mode = db9_cfg[i].args[DB9_ARG_MODE]; + mode = db9_cfg[port_idx].args[DB9_ARG_MODE]; if (mode < 1 || mode >= DB9_MAX_PAD || !db9_modes[mode].n_buttons) { printk(KERN_ERR "db9.c: Bad device type %d\n", mode); @@ -594,7 +594,7 @@ static void db9_attach(struct parport *pp) db9_parport_cb.flags = PARPORT_FLAG_EXCL; - pd = parport_register_dev_model(pp, "db9", &db9_parport_cb, i); + pd = parport_register_dev_model(pp, "db9", &db9_parport_cb, port_idx); if (!pd) { printk(KERN_ERR "db9.c: parport busy already - lp.o loaded?\n"); return; @@ -649,7 +649,7 @@ static void db9_attach(struct parport *pp) goto err_free_dev; } - db9_base[i] = db9; + db9_base[port_idx] = db9; return; err_free_dev: @@ -676,6 +676,7 @@ static void db9_detach(struct parport *port) return; db9 = db9_base[i]; + db9_base[i] = NULL; for (i = 0; i < min(db9_modes[db9->mode].n_pads, DB9_MAX_DEVICES); i++) input_unregister_device(db9->dev[i]); -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists