lkml.org 
[lkml]   [2016]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] intel_menlow: prevent NULL pointer dereference
On Wed, May 25, 2016 at 04:20:11PM +0200, Vincent Stehlé wrote:
> The function acpi_driver_data() will dereference its parameter; make sure
> to check for NULL pointer before we call it.

+Rafael

Under what circumstances can the .remove op be called with a NULL struct
acpi_device * as a parameter? From what I can see, most acpi_* calls accpeting
an acpi_device rely on it not being null, and they are regularly called from
driver remove functions.

Did you observe an explicit failure or can you describe a call path where this
can occur?


>
> Signed-off-by: Vincent Stehlé <vincent.stehle@intel.com>
> Cc: Sujith Thomas <sujith.thomas@intel.com>
> Cc: Darren Hart <dvhart@infradead.org>
> Cc: Zhang Rui <rui.zhang@intel.com>
> Cc: Len Brown <len.brown@intel.com>
> ---
> drivers/platform/x86/intel_menlow.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/platform/x86/intel_menlow.c b/drivers/platform/x86/intel_menlow.c
> index 0a919d8..185a1bd 100644
> --- a/drivers/platform/x86/intel_menlow.c
> +++ b/drivers/platform/x86/intel_menlow.c
> @@ -196,9 +196,13 @@ static int intel_menlow_memory_add(struct acpi_device *device)
>
> static int intel_menlow_memory_remove(struct acpi_device *device)
> {
> - struct thermal_cooling_device *cdev = acpi_driver_data(device);
> + struct thermal_cooling_device *cdev;
> +
> + if (!device)
> + return -EINVAL;
>
> - if (!device || !cdev)
> + cdev = acpi_driver_data(device);
> + if (!cdev)
> return -EINVAL;
>
> sysfs_remove_link(&device->dev.kobj, "thermal_cooling");
> --
> 2.8.1
>
>

--
Darren Hart
Intel Open Source Technology Center

\
 
 \ /
  Last update: 2016-06-08 23:21    [W:0.834 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site