diff options
| author | David S. Miller <davem@sunset.davemloft.net> | 2006-09-18 01:47:13 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-09-18 01:47:13 -0700 |
| commit | b9b64e6e89fc5a6ef220747115c5b7764614ca3f (patch) | |
| tree | 2d28434f793807b4a83bd5dc139e165c7c317389 /drivers/sbus/char | |
| parent | 803db244b9f71102e366fd689000c1417b9a7508 (diff) | |
[OPENPROMIO]: Handle current_node being NULL correctly.
If the user tries to traverse to the next node of the
last node, we get NULL in current_node and a zero phandle
returned. That's fine, but if the user tries to obtain
properties in that state, we try to dereference a NULL
pointer in the downcall to the of_*() routines.
So protect against that.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/sbus/char')
| -rw-r--r-- | drivers/sbus/char/openprom.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c index 293bb2fdb1d..2f698763ba5 100644 --- a/drivers/sbus/char/openprom.c +++ b/drivers/sbus/char/openprom.c @@ -145,8 +145,9 @@ static int opromgetprop(void __user *argp, struct device_node *dp, struct openpr void *pval; int len; - pval = of_get_property(dp, op->oprom_array, &len); - if (!pval || len <= 0 || len > bufsize) + if (!dp || + !(pval = of_get_property(dp, op->oprom_array, &len)) || + len <= 0 || len > bufsize) return copyout(argp, op, sizeof(int)); memcpy(op->oprom_array, pval, len); @@ -161,6 +162,8 @@ static int opromnxtprop(void __user *argp, struct device_node *dp, struct openpr struct property *prop; int len; + if (!dp) + return copyout(argp, op, sizeof(int)); if (op->oprom_array[0] == '\0') { prop = dp->properties; if (!prop) @@ -266,9 +269,13 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp static int oprompath2node(void __user *argp, struct device_node *dp, struct openpromio *op, int bufsize, DATA *data) { + phandle ph = 0; + dp = of_find_node_by_path(op->oprom_array); + if (dp) + ph = dp->node; data->current_node = dp; - *((int *)op->oprom_array) = dp->node; + *((int *)op->oprom_array) = ph; op->oprom_size = sizeof(int); return copyout(argp, op, bufsize + sizeof(int)); |