Commit 128b3af4 authored by Ben Collins's avatar Ben Collins

ieee1394: Fix possible NULL ptr dereference with calls to find_ctx()

Submitted-by: default avatarHiromasa YOSHIMOTO <yosimoto@limu.is.kyushu-u.ac.jp>
Signed-off-by: default avatarBen Collins <bcollins@debian.org>
parent 26a3e565
...@@ -864,6 +864,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file, ...@@ -864,6 +864,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
return -EFAULT; return -EFAULT;
d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel); d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
if (d == NULL) return -EFAULT;
if ((v.buffer<0) || (v.buffer>d->num_desc)) { if ((v.buffer<0) || (v.buffer>d->num_desc)) {
PRINT(KERN_ERR, ohci->host->id, PRINT(KERN_ERR, ohci->host->id,
...@@ -926,6 +927,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file, ...@@ -926,6 +927,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
return -EFAULT; return -EFAULT;
d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel); d = find_ctx(&ctx->context_list, OHCI_ISO_RECEIVE, v.channel);
if (d == NULL) return -EFAULT;
if ((v.buffer<0) || (v.buffer>d->num_desc)) { if ((v.buffer<0) || (v.buffer>d->num_desc)) {
PRINT(KERN_ERR, ohci->host->id, PRINT(KERN_ERR, ohci->host->id,
...@@ -1009,6 +1011,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file, ...@@ -1009,6 +1011,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
return -EFAULT; return -EFAULT;
d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel); d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
if (d == NULL) return -EFAULT;
if ((v.buffer<0) || (v.buffer>d->num_desc)) { if ((v.buffer<0) || (v.buffer>d->num_desc)) {
PRINT(KERN_ERR, ohci->host->id, PRINT(KERN_ERR, ohci->host->id,
...@@ -1112,6 +1115,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file, ...@@ -1112,6 +1115,7 @@ static int video1394_ioctl(struct inode *inode, struct file *file,
return -EFAULT; return -EFAULT;
d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel); d = find_ctx(&ctx->context_list, OHCI_ISO_TRANSMIT, v.channel);
if (d == NULL) return -EFAULT;
if ((v.buffer<0) || (v.buffer>d->num_desc)) { if ((v.buffer<0) || (v.buffer>d->num_desc)) {
PRINT(KERN_ERR, ohci->host->id, PRINT(KERN_ERR, ohci->host->id,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment