patch "staging: comedi: jr3_pci: fix possible null pointer dereference" added to staging-next

This is a note to let you know that I've just added the patch titled

staging: comedi: jr3_pci: fix possible null pointer dereference

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-next branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will also be merged in the next major kernel release during the merge window.

If you have any questions about this process, please let me know.

From: Ian Abbott <[email protected]>
Date: Fri, 17 Feb 2017 11:09:08 +0000
Subject: staging: comedi: jr3_pci: fix possible null pointer dereference

For some reason, the driver does not consider allocation of the subdevice private data to be a fatal error when attaching the COMEDI device. It tests the subdevice private data pointer for validity at certain points, but omits some crucial tests. In particular, jr3_pci_auto_attach() calls jr3_pci_alloc_spriv() to allocate and initialize the subdevice private data, but the same function subsequently dereferences the pointer to access the next_time_min and next_time_max members without checking it first. The other missing test is in the timer expiry routine jr3_pci_poll_dev(), but it will crash before it gets that far.

Fix the bug by returning -ENOMEM from jr3_pci_auto_attach() as soon as one of the calls to jr3_pci_alloc_spriv() returns NULL. The COMEDI core will subsequently call jr3_pci_detach() to clean up.

---
 drivers/staging/comedi/drivers/jr3_pci.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

index 70390de66e0e..25909a936e7c 100644
@@ -727,11 +727,12 @@ static int jr3_pci_auto_attach(struct comedi_device *dev,
 		s->insn_read	= jr3_pci_ai_insn_read;
 
 		spriv = jr3_pci_alloc_spriv(dev, s);
-		if (spriv) {
-			/* Channel specific range and maxdata */
-			s->range_table_list	= spriv->range_table_list;
-			s->maxdata_list		= spriv->maxdata_list;
-		}
+		if (!spriv)
+			return -ENOMEM;
+
+		/* Channel specific range and maxdata */
+		s->range_table_list	= spriv->range_table_list;
+		s->maxdata_list		= spriv->maxdata_list;
 	}
 
 	/* Reset DSP card */

2.12.0