From patchwork Wed Sep 22 11:06:43 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brian Rogers X-Patchwork-Id: 199002 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id o8MBBS5K004917 for ; Wed, 22 Sep 2010 11:11:28 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753328Ab0IVLL1 (ORCPT ); Wed, 22 Sep 2010 07:11:27 -0400 Received: from qmta06.emeryville.ca.mail.comcast.net ([76.96.30.56]:37841 "EHLO qmta06.emeryville.ca.mail.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753326Ab0IVLL0 (ORCPT ); Wed, 22 Sep 2010 07:11:26 -0400 Received: from omta01.emeryville.ca.mail.comcast.net ([76.96.30.11]) by qmta06.emeryville.ca.mail.comcast.net with comcast id 9nBS1f0010EPchoA6nBS6j; Wed, 22 Sep 2010 11:11:26 +0000 Received: from rumblered.hsd1.wa.comcast.net. ([71.236.132.121]) by omta01.emeryville.ca.mail.comcast.net with comcast id 9nBN1f0052dJgfb8MnBRtk; Wed, 22 Sep 2010 11:11:25 +0000 From: Brian Rogers To: Mauro Carvalho Chehab Cc: =?UTF-8?q?David=20H=C3=A4rdeman?= , Jarod Wilson , linux-media@vger.kernel.org, linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Brian Rogers Subject: [PATCH] ir-core: Fix null dereferences in the protocols sysfs interface Date: Wed, 22 Sep 2010 04:06:43 -0700 Message-Id: <1285153603-1527-1-git-send-email-brian@xyzw.org> X-Mailer: git-send-email 1.7.1 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter1.kernel.org [140.211.167.41]); Wed, 22 Sep 2010 11:11:28 +0000 (UTC) diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c index 96dafc4..46d4246 100644 --- a/drivers/media/IR/ir-sysfs.c +++ b/drivers/media/IR/ir-sysfs.c @@ -67,13 +67,14 @@ static ssize_t show_protocols(struct device *d, char *tmp = buf; int i; - if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) { + if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) { enabled = ir_dev->rc_tab.ir_type; allowed = ir_dev->props->allowed_protos; - } else { + } else if (ir_dev->raw) { enabled = ir_dev->raw->enabled_protocols; allowed = ir_raw_get_allowed_protocols(); - } + } else + return sprintf(tmp, "[builtin]\n"); IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n", (long long)allowed, @@ -121,10 +122,14 @@ static ssize_t store_protocols(struct device *d, int rc, i, count = 0; unsigned long flags; - if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) + if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) type = ir_dev->rc_tab.ir_type; - else + else if (ir_dev->raw) type = ir_dev->raw->enabled_protocols; + else { + IR_dprintk(1, "Protocol switching not supported\n"); + return -EINVAL; + } while ((tmp = strsep((char **) &data, " \n")) != NULL) { if (!*tmp) @@ -185,7 +190,7 @@ static ssize_t store_protocols(struct device *d, } } - if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) { + if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) { spin_lock_irqsave(&ir_dev->rc_tab.lock, flags); ir_dev->rc_tab.ir_type = type; spin_unlock_irqrestore(&ir_dev->rc_tab.lock, flags);