Messages in this thread | | | Date | Wed, 8 Jun 2016 13:38:46 -0700 | From | Darren Hart <> | Subject | Re: [PATCH] intel_menlow: prevent NULL pointer dereference |
| |
On Wed, May 25, 2016 at 04:20:11PM +0200, Vincent Stehlé wrote: > The function acpi_driver_data() will dereference its parameter; make sure > to check for NULL pointer before we call it.
+Rafael
Under what circumstances can the .remove op be called with a NULL struct acpi_device * as a parameter? From what I can see, most acpi_* calls accpeting an acpi_device rely on it not being null, and they are regularly called from driver remove functions.
Did you observe an explicit failure or can you describe a call path where this can occur?
> > Signed-off-by: Vincent Stehlé <vincent.stehle@intel.com> > Cc: Sujith Thomas <sujith.thomas@intel.com> > Cc: Darren Hart <dvhart@infradead.org> > Cc: Zhang Rui <rui.zhang@intel.com> > Cc: Len Brown <len.brown@intel.com> > --- > drivers/platform/x86/intel_menlow.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/platform/x86/intel_menlow.c b/drivers/platform/x86/intel_menlow.c > index 0a919d8..185a1bd 100644 > --- a/drivers/platform/x86/intel_menlow.c > +++ b/drivers/platform/x86/intel_menlow.c > @@ -196,9 +196,13 @@ static int intel_menlow_memory_add(struct acpi_device *device) > > static int intel_menlow_memory_remove(struct acpi_device *device) > { > - struct thermal_cooling_device *cdev = acpi_driver_data(device); > + struct thermal_cooling_device *cdev; > + > + if (!device) > + return -EINVAL; > > - if (!device || !cdev) > + cdev = acpi_driver_data(device); > + if (!cdev) > return -EINVAL; > > sysfs_remove_link(&device->dev.kobj, "thermal_cooling"); > -- > 2.8.1 > >
-- Darren Hart Intel Open Source Technology Center
| |