patch "staging: comedi: ni_routes: fix null dereference in" added to staging-linus

This is a note to let you know that I've just added the patch titled

staging: comedi: ni_routes: fix null dereference in

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From 01e20b664f808a4f3048ca3f930911fd257209bd Mon Sep 17 00:00:00 2001
From: Ian Abbott <[email protected]>
Date: Tue, 14 Jan 2020 18:25:31 +0000
Subject: staging: comedi: ni_routes: fix null dereference in
ni_find_route_source()

In ni_find_route_source(), tables->route_values gets dereferenced. However it is possible that tables->route_values is NULL, leading to a null pointer dereference. tables->route_values will be NULL if the call to ni_assign_device_routes() during board initialization returned an error due to missing device family routing information or missing board-specific routing information. For example, there is currently no board-specific routing information provided for the PCIe-6251 board and several other boards, so those are affected by this bug.

The bug is triggered when ni_find_route_source() is called via ni_check_trigger_arg() or ni_check_trigger_arg_roffs() when checking the arguments for setting up asynchronous commands. Fix it by returning -EINVAL if tables->route_values is NULL.

Even with this fix, setting up asynchronous commands to use external trigger sources for boards with missing routing information will still fail gracefully. Since ni_find_route_source() only depends on the device family routing information, it would be better if that was made available even if the board-specific routing information is missing. That will be addressed by another patch.

---
 drivers/staging/comedi/drivers/ni_routes.c | 3 +++
 1 file changed, 3 insertions(+)

index 673d732dcb8f..9627bd1d2a78 100644
@@ -487,6 +487,9 @@ int ni_find_route_source(const u8 src_sel_reg_value, int dest,
 {
 	int src;
 
+	if (!tables->route_values)
+		return -EINVAL;
+
 	dest = B(dest); /* subtract NI names offset */
 	/* ensure we are not going to under/over run the route value table */
 	if (dest < 0 || dest >= NI_NUM_NAMES)

2.24.1