From patchwork Wed Jul 28 16:50:36 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Ramos Falcon, Ernesto" X-Patchwork-Id: 114863 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.4/8.14.3) with ESMTP id o6SGk7WV002568 for ; Wed, 28 Jul 2010 16:46:07 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754957Ab0G1QqF (ORCPT ); Wed, 28 Jul 2010 12:46:05 -0400 Received: from devils.ext.ti.com ([198.47.26.153]:49243 "EHLO devils.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754246Ab0G1QqE (ORCPT ); Wed, 28 Jul 2010 12:46:04 -0400 Received: from dlep33.itg.ti.com ([157.170.170.112]) by devils.ext.ti.com (8.13.7/8.13.7) with ESMTP id o6SGjqCp019523 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 28 Jul 2010 11:45:52 -0500 Received: from emcc1.sasken-mty.naucm.ext.ti.com (localhost [127.0.0.1]) by dlep33.itg.ti.com (8.13.7/8.13.7) with ESMTP id o6SGjpRV011963; Wed, 28 Jul 2010 11:45:51 -0500 (CDT) Received: from localhost.localdomain (x0076199-desktop.sasken-mty.naucm.ext.ti.com [10.87.230.107]) by emcc1.sasken-mty.naucm.ext.ti.com (8.13.8+Sun/8.13.8) with ESMTP id o6SGjkDE026439; Wed, 28 Jul 2010 11:45:47 -0500 (CDT) From: Ernesto Ramos To: gregkh@suse.de Cc: omar.ramirez@ti.com, ohad@wizery.com, ameya.palande@nokia.com, felipe.contreras@nokia.com, fernando.lugo@ti.com, linux-kernel@vger.kernel.org, andy.shevchenko@gmail.com, nm@ti.com, linux-omap@vger.kernel.org, Ernesto Ramos Subject: [PATCH] staging:ti dspbridge: avoid possible NULL dereference panic Date: Wed, 28 Jul 2010 11:50:36 -0500 Message-Id: <1280335836-31801-1-git-send-email-ernesto@ti.com> X-Mailer: git-send-email 1.5.4.5 Sender: linux-omap-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-omap@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Wed, 28 Jul 2010 16:46:07 +0000 (UTC) diff --git a/drivers/staging/tidspbridge/pmgr/dspapi.c b/drivers/staging/tidspbridge/pmgr/dspapi.c index 1b0ab4a..da08dfc 100644 --- a/drivers/staging/tidspbridge/pmgr/dspapi.c +++ b/drivers/staging/tidspbridge/pmgr/dspapi.c @@ -539,7 +539,7 @@ func_end: */ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) { - int status = 0, real_status = 0; + int status = 0; struct dsp_notification *anotifications[MAX_EVENTS]; struct dsp_notification notifications[MAX_EVENTS]; u32 index, i; @@ -554,19 +554,21 @@ u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt) /* get the events */ for (i = 0; i < count; i++) { CP_FM_USR(¬ifications[i], anotifications[i], status, 1); - if (!status) { - /* set the array of pointers to kernel structures */ - anotifications[i] = ¬ifications[i]; + if (status || !notifications[i].handle) { + status = -EINVAL; + break; } + /* set the array of pointers to kernel structures */ + anotifications[i] = ¬ifications[i]; } if (!status) { - real_status = mgr_wait_for_bridge_events(anotifications, count, + status = mgr_wait_for_bridge_events(anotifications, count, &index, args->args_mgr_wait. utimeout); } CP_TO_USR(args->args_mgr_wait.pu_index, &index, status, 1); - return real_status; + return status; } /*