[PATCH] staging:ti dspbridge: avoid possible NULL dereference panic

[Ernesto Ramos]

When dsp_notifications array is received from user,
dspbridge verifies the array has valid pointers
and dsp_notification structures. However, these
structures contain pointers that need to be
checked for valid handles.

Signed-off-by: Ernesto Ramos <erne...@ti.com>
---
 drivers/staging/tidspbridge/pmgr/dspapi.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/tidspbridge/pmgr/dspapi.c 
b/drivers/staging/tidspbridge/pmgr/dspapi.c
index 1b0ab4a..da08dfc 100644
--- a/drivers/staging/tidspbridge/pmgr/dspapi.c
+++ b/drivers/staging/tidspbridge/pmgr/dspapi.c
@@ -539,7 +539,7 @@ func_end:
  */
 u32 mgrwrap_wait_for_bridge_events(union trapped_args *args, void *pr_ctxt)
 {
-       int status = 0, real_status = 0;
+       int status = 0;
        struct dsp_notification *anotifications[MAX_EVENTS];
        struct dsp_notification notifications[MAX_EVENTS];
        u32 index, i;
@@ -554,19 +554,21 @@ u32 mgrwrap_wait_for_bridge_events(union trapped_args 
*args, void *pr_ctxt)
        /* get the events */
        for (i = 0; i < count; i++) {
                CP_FM_USR(&notifications[i], anotifications[i], status, 1);
-               if (!status) {
-                       /* set the array of pointers to kernel structures */
-                       anotifications[i] = &notifications[i];
+               if (status || !notifications[i].handle) {
+                       status = -EINVAL;
+                       break;
                }
+               /* set the array of pointers to kernel structures */
+               anotifications[i] = &notifications[i];
        }
        if (!status) {
-               real_status = mgr_wait_for_bridge_events(anotifications, count,
+               status = mgr_wait_for_bridge_events(anotifications, count,
                                                         &index,
                                                         args->args_mgr_wait.
                                                         utimeout);
        }
        CP_TO_USR(args->args_mgr_wait.pu_index, &index, status, 1);
-       return real_status;
+       return status;
 }
 
 /*
-- 
1.5.4.5

--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html