Commit 41603e9783a24c8c7cce548c0819bdc9e46a585b
Committed by
Matthew Garrett
1 parent
a979e2e2af
Exists in
smarc-l5.0.0_1.0.0-ga
and in
5 other branches
drivers/platform/x86/amilo-rfkill.c::amilo_rfkill_probe() avoid NULL deref
In drivers/platform/x86/amilo-rfkill.c::amilo_rfkill_probe() the call to dmi_first_match() may fail and return NULL. If it does return NULL, then we'll be dereferencing a NULL pointer in the rfkill_alloc() call where we do 'system_id->driver_data' --> KABOOM! Avoid that problem by testing for a NULL return value from dmi_first_match() and bailing out if it fails. I was a bit uncertain about what to return in the failure case. In the end I settled for -ENXIO as the most logical error to return. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Matthew Garrett <mjg@redhat.com>
Showing 1 changed file with 4 additions and 1 deletions Side-by-side Diff
drivers/platform/x86/amilo-rfkill.c
... | ... | @@ -97,9 +97,12 @@ |
97 | 97 | |
98 | 98 | static int __devinit amilo_rfkill_probe(struct platform_device *device) |
99 | 99 | { |
100 | + int rc; | |
100 | 101 | const struct dmi_system_id *system_id = |
101 | 102 | dmi_first_match(amilo_rfkill_id_table); |
102 | - int rc; | |
103 | + | |
104 | + if (!system_id) | |
105 | + return -ENXIO; | |
103 | 106 | |
104 | 107 | amilo_rfkill_dev = rfkill_alloc(KBUILD_MODNAME, &device->dev, |
105 | 108 | RFKILL_TYPE_WLAN, |