patch "staging: comedi: dt282x: fix a null pointer deref on interrupt" added to staging-testing

This is a note to let you know that I've just added the patch titled

staging: comedi: dt282x: fix a null pointer deref on interrupt

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-testing branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will be merged to the staging-next branch sometime soon, after it passes testing, and the merge window is open.

If you have any questions about this process, please let me know.

From b8336be66dec06bef518030a0df9847122053ec5 Mon Sep 17 00:00:00 2001
From: Ian Abbott <[email protected]>
Date: Wed, 26 Jun 2019 14:18:04 +0100
Subject: staging: comedi: dt282x: fix a null pointer deref on interrupt

The interrupt handler dt282x_interrupt() causes a null pointer dereference for those supported boards that have no analog output support. For these boards, dev->write_subdev will be NULL and therefore the s_ao subdevice pointer variable will be NULL. In that case, the following call near the end of the interrupt handler results in a null pointer dereference:

	comedi_handle_events(dev, s_ao);

Fix it by only calling the above function if s_ao is valid.

(There are other uses of s_ao by the interrupt handler that may or may not be reached depending on values of hardware registers. Trust that they are reliable for now.)

Note:
commit 4f6f009b204f ("staging: comedi: dt282x: use comedi_handle_events()") propagates an earlier error from
commit f21c74fa4cfe ("staging: comedi: dt282x: use cfc_handle_events()").

---
 drivers/staging/comedi/drivers/dt282x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 3be927f1d3a9..e15e33ed94ae 100644
@@ -557,7 +557,8 @@ static irqreturn_t dt282x_interrupt(int irq, void *d)
 	}
 #endif
 	comedi_handle_events(dev, s);
-	comedi_handle_events(dev, s_ao);
+	if (s_ao)
+		comedi_handle_events(dev, s_ao);
 
 	return IRQ_RETVAL(handled);
 }

2.22.0