From: Dan Carpenter <dan.carpenter@oracle.com>
To: "Jacek Anaszewski" <jacek.anaszewski@gmail.com>,
"Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
Cc: Pavel Machek <pavel@ucw.cz>, Dan Murphy <dmurphy@ti.com>,
linux-leds@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] led: triggers: Fix NULL dereference in led_trigger_set() error handling
Date: Thu, 5 Sep 2019 12:57:28 +0300 [thread overview]
Message-ID: <20190905095728.GA26005@mwanda> (raw)
The problem is we set "led_cdev->trigger = NULL;" and then dereference
it when we call write_lock_irqsave():
write_lock_irqsave(&led_cdev->trigger->leddev_list_lock, flags);
^^^^^^^^^^^^^^^^^
Fixes: 2282e125a406 ("leds: triggers: let struct led_trigger::activate() return an error code")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/leds/led-triggers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
index eff1bda8b520..13cea227277c 100644
--- a/drivers/leds/led-triggers.c
+++ b/drivers/leds/led-triggers.c
@@ -167,12 +167,12 @@ int led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trig)
trig->deactivate(led_cdev);
err_activate:
- led_cdev->trigger = NULL;
- led_cdev->trigger_data = NULL;
write_lock_irqsave(&led_cdev->trigger->leddev_list_lock, flags);
list_del(&led_cdev->trig_list);
write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags);
+ led_cdev->trigger = NULL;
+ led_cdev->trigger_data = NULL;
led_set_brightness(led_cdev, LED_OFF);
kfree(event);
return ret;
--
2.20.1
next reply other threads:[~2019-09-05 9:57 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-05 9:57 Dan Carpenter [this message]
2019-09-05 11:22 ` [PATCH] led: triggers: Fix NULL dereference in led_trigger_set() error handling Oleh Kravchenko
2019-09-05 12:06 ` Uwe Kleine-König
2019-09-05 12:23 ` Oleh Kravchenko
2019-09-05 12:46 ` Uwe Kleine-König
2019-09-05 20:41 ` Jacek Anaszewski
2019-09-05 13:32 ` Dan Carpenter
2019-09-08 9:46 ` Oleh Kravchenko
2019-09-05 12:39 ` Oleh Kravchenko
2019-09-05 13:04 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190905095728.GA26005@mwanda \
--to=dan.carpenter@oracle.com \
--cc=dmurphy@ti.com \
--cc=jacek.anaszewski@gmail.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-leds@vger.kernel.org \
--cc=pavel@ucw.cz \
--cc=u.kleine-koenig@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).