patch "staging: comedi: amplc_pci230: fix null pointer deref on interrupt" added to staging-testing

This is a note to let you know that I've just added the patch titled

staging: comedi: amplc_pci230: fix null pointer deref on interrupt

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will be merged to the staging-next branch sometime soon, after it passes testing, and the merge window is open.

If you have any questions about this process, please let me know.

From 7379e6baeddf580d01feca650ec1ad508b6ea8ee Mon Sep 17 00:00:00 2001
From: Ian Abbott <[email protected]>
Date: Wed, 26 Jun 2019 14:17:39 +0100
Subject: staging: comedi: amplc_pci230: fix null pointer deref on interrupt

The interrupt handler pci230_interrupt() causes a null pointer dereference for a PCI260 card. There is no analog output subdevice for a PCI260. The dev->write_subdev subdevice pointer and therefore the s_ao subdevice pointer variable will be NULL for a PCI260. The following call near the end of the interrupt handler results in the null pointer dereference for a PCI260:

	comedi_handle_events(dev, s_ao);

Fix it by only calling the above function if s_ao is valid.

Note that the other uses of s_ao in the calls pci230_handle_ao_nofifo(dev, s_ao); and pci230_handle_ao_fifo(dev, s_ao); will never be reached for a PCI260, so they are safe.

---
 drivers/staging/comedi/drivers/amplc_pci230.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 65f60c2b702a..f7e673121864 100644
@@ -2330,7 +2330,8 @@ static irqreturn_t pci230_interrupt(int irq, void *d)
 	devpriv->intr_running = false;
 	spin_unlock_irqrestore(&devpriv->isr_spinlock, irqflags);
 
-	comedi_handle_events(dev, s_ao);
+	if (s_ao)
+		comedi_handle_events(dev, s_ao);
 	comedi_handle_events(dev, s_ai);
 
 	return IRQ_HANDLED;

2.22.0