hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

staging: ti dspbridge: avoid possible NULL dereference panic 

When dsp_notifications array is received from user,
dspbridge verifies the array has valid pointers
and dsp_notification structures. However, these
structures contain pointers that need to be
checked for valid handles.

Signed-off-by: Ernesto Ramos <ernesto@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Ernesto Ramos 2010-07-28 11:50:36 -05:00 committed by Greg Kroah-Hartman
parent 019415ce5e
commit 35f338e4f2
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/staging/tidspbridge/pmgr/dspapi.c
View File

@ -539,7 +539,7 @@ func_end:
*/
u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt)
{
int status = 0, real_status = 0;
int status = 0;
struct dsp_notification *anotifications[MAX_EVENTS];
struct dsp_notification notifications[MAX_EVENTS];
u32 index, i;
@ -554,19 +554,21 @@ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt)
/* get the events */
for (i = 0; i < count; i++) {
CP_FM_USR(&notifications[i], anotifications[i], status, 1);
if (!status) {
/* set the array of pointers to kernel structures */
anotifications[i] = &notifications[i];
if (status || !notifications[i].handle) {
status = -EINVAL;
break;
}
/* set the array of pointers to kernel structures */
anotifications[i] = &notifications[i];
}
if (!status) {
real_status = mgr_wait_for_bridge_events(anotifications, count,
status = mgr_wait_for_bridge_events(anotifications, count,
&index,
args->args_mgr_wait.
utimeout);
}
CP_TO_USR(args->args_mgr_wait.pu_index, &index, status, 1);
return real_status;
return status;
}
/*