Commit 6cab7a37 authored by Ian Abbott's avatar Ian Abbott Committed by Greg Kroah-Hartman

staging: comedi: (regression) channel list must be set for COMEDI_CMD ioctl

`do_cmd_ioctl()`, the handler for the `COMEDI_CMD` ioctl can incorrectly
call the Comedi subdevice's `do_cmd()` handler with a NULL channel list
pointer.  This is a regression as the `do_cmd()` handler has never been
expected to deal with that, leading to a kernel OOPS when it tries to
dereference it.

A NULL channel list pointer is allowed for the `COMEDI_CMDTEST` ioctl,
handled by `do_cmdtest_ioctl()` and the subdevice's `do_cmdtest()`
handler, but not for the `COMEDI_CMD` ioctl and its handlers.

Both `do_cmd_ioctl()` and `do_cmdtest_ioctl()` call
`__comedi_get_user_chanlist()` to copy the channel list from user memory
into dynamically allocated kernel memory and check it for consistency.
That function currently returns 0 if the `user_chanlist` parameter
(pointing to the channel list in user memory) is NULL.  That's fine for
`do_cmdtest_ioctl()`, but `do_cmd_ioctl()` incorrectly assumes the
kernel copy of the channel list has been set-up correctly.

Fix it by not allowing the `user_chanlist` parameter to be NULL in
`__comedi_get_user_chanlist()`, and only calling it from
`do_cmdtest_ioctl()` if the parameter is non-NULL.

Thanks to Bernd Porr for reporting the bug via an initial patch sent
privately.

Fixes: c6cd0eef ("staging: comedi: comedi_fops: introduce __comedi_get_user_chanlist()")
Reported-by: default avatarBernd Porr <mail@berndporr.me.uk>
Signed-off-by: default avatarIan Abbott <abbotti@mev.co.uk>
Reviewed-by: default avatarH Hartley Sweeten <hsweeten@visionengravers.com>
Cc: Bernd Porr <mail@berndporr.me.uk>
Cc: <stable@vger.kernel.org> # 3.15.y 3.16.y 3.17.y
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f114040e
...@@ -1462,10 +1462,6 @@ static int __comedi_get_user_chanlist(struct comedi_device *dev, ...@@ -1462,10 +1462,6 @@ static int __comedi_get_user_chanlist(struct comedi_device *dev,
unsigned int *chanlist; unsigned int *chanlist;
int ret; int ret;
/* user_chanlist could be NULL for do_cmdtest ioctls */
if (!user_chanlist)
return 0;
chanlist = memdup_user(user_chanlist, chanlist = memdup_user(user_chanlist,
cmd->chanlist_len * sizeof(unsigned int)); cmd->chanlist_len * sizeof(unsigned int));
if (IS_ERR(chanlist)) if (IS_ERR(chanlist))
...@@ -1609,10 +1605,13 @@ static int do_cmdtest_ioctl(struct comedi_device *dev, ...@@ -1609,10 +1605,13 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
s = &dev->subdevices[cmd.subdev]; s = &dev->subdevices[cmd.subdev];
/* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */
if (user_chanlist) {
/* load channel/gain list */ /* load channel/gain list */
ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd); ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
if (ret) if (ret)
return ret; return ret;
}
ret = s->do_cmdtest(dev, s, &cmd); ret = s->do_cmdtest(dev, s, &cmd);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment