[PATCH] Avoid null-pointer access in w1/slaves/w1_therm

From: "Thorsten.Bschorr" <thorsten@bschorr.de>
To: linux-kernel@vger.kernel.org
Cc: Evgeniy Polyakov <zbr@ioremap.net>, David Fries <David@Fries.net>
Subject: [PATCH] Avoid null-pointer access in w1/slaves/w1_therm
Date: Fri, 27 Feb 2015 09:43:14 +0100	[thread overview]
Message-ID: <54F02E22.5050901@bschorr.de> (raw)
In-Reply-To: <CA+1k2cH5Y+RngvEbgE3CW5g+bO3V1ytDJC=u6DLVDZvbEOhu5A@mail.gmail.com>

w1_slave_show unlocks the bus while waiting for the sensor
to convert the temperature. If the sensor gets disconnected
during that time, sl->family_data could get NULL.
Note: the w1_slave pointer inside w1_slave_show is protected by
sysfs-mutex
---
 drivers/w1/slaves/w1_therm.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 1f11a20..3a14cb1 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -236,6 +236,12 @@ static ssize_t w1_slave_show(struct device *device,
 				i = mutex_lock_interruptible(&dev->bus_mutex);
 				if (i != 0)
 					return i;
+
+				/* Ensure that device is still there -
+				 * it could have gone while we unlocked the bus.
+				 * Note: sl is still protected by sysfs-mutex */
+				if(!sl->family_data)
+					return -ENODEV;
 			} else if (!w1_strong_pullup) {
 				sleep_rem = msleep_interruptible(tm);
 				if (sleep_rem != 0) {
-- 
1.8.4.5


---
Diese E-Mail wurde von Avast Antivirus-Software auf Viren geprüft.
http://www.avast.com

