lkml.org 
[lkml]   [2013]   [Sep]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 57/93] HID: picolcd: Prevent NULL pointer dereference on _remove()
    Date
    3.8.13.10 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: =?UTF-8?q?Bruno=20Pr=C3=A9mont?= <bonbons@linux-vserver.org>

    commit 1cde501bb4655e98fb832194beb88ac73be5a05d upstream.

    When picolcd is switched into bootloader mode (for FW flashing) make
    sure not to try to dereference NULL-pointers of feature-devices during
    unplug/unbind.

    This fixes following BUG:
    BUG: unable to handle kernel NULL pointer dereference at 00000298
    IP: [<f811f56b>] picolcd_exit_framebuffer+0x1b/0x80 [hid_picolcd]
    *pde = 00000000
    Oops: 0000 [#1]
    Modules linked in: hid_picolcd syscopyarea sysfillrect sysimgblt fb_sys_fops
    CPU: 0 PID: 15 Comm: khubd Not tainted 3.11.0-rc7-00002-g50d62d4 #2
    EIP: 0060:[<f811f56b>] EFLAGS: 00010292 CPU: 0
    EIP is at picolcd_exit_framebuffer+0x1b/0x80 [hid_picolcd]
    Call Trace:
    [<f811d1ab>] picolcd_remove+0xcb/0x120 [hid_picolcd]
    [<c1469b09>] hid_device_remove+0x59/0xc0
    [<c13464ca>] __device_release_driver+0x5a/0xb0
    [<c134653f>] device_release_driver+0x1f/0x30
    [<c134603d>] bus_remove_device+0x9d/0xd0
    [<c13439a5>] device_del+0xd5/0x150
    [<c14696a4>] hid_destroy_device+0x24/0x60
    [<c1474cbb>] usbhid_disconnect+0x1b/0x40
    ...

    Signed-off-by: Bruno Prémont <bonbons@linux-vserver.org>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    drivers/hid/hid-picolcd_cir.c | 3 ++-
    drivers/hid/hid-picolcd_fb.c | 6 +++++-
    2 files changed, 7 insertions(+), 2 deletions(-)

    diff --git a/drivers/hid/hid-picolcd_cir.c b/drivers/hid/hid-picolcd_cir.c
    index a79e95b..1a79a1e 100644
    --- a/drivers/hid/hid-picolcd_cir.c
    +++ b/drivers/hid/hid-picolcd_cir.c
    @@ -147,6 +147,7 @@ void picolcd_exit_cir(struct picolcd_data *data)
    struct rc_dev *rdev = data->rc_dev;

    data->rc_dev = NULL;
    - rc_unregister_device(rdev);
    + if (rdev)
    + rc_unregister_device(rdev);
    }

    diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c
    index eb00357..104df56 100644
    --- a/drivers/hid/hid-picolcd_fb.c
    +++ b/drivers/hid/hid-picolcd_fb.c
    @@ -595,10 +595,14 @@ err_nomem:
    void picolcd_exit_framebuffer(struct picolcd_data *data)
    {
    struct fb_info *info = data->fb_info;
    - struct picolcd_fb_data *fbdata = info->par;
    + struct picolcd_fb_data *fbdata;
    unsigned long flags;

    + if (!info)
    + return;
    +
    device_remove_file(&data->hdev->dev, &dev_attr_fb_update_rate);
    + fbdata = info->par;

    /* disconnect framebuffer from HID dev */
    spin_lock_irqsave(&fbdata->lock, flags);
    --
    1.8.1.2
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2013-09-20 23:21    [W:4.038 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site