[PATCH 3/5 v3] drivers/hid/hid-roccat.c: eliminate a null pointer dereference
From: Julia Lawall <hidden>
Date: 2011-10-29 18:45:46
Also in:
kernel-janitors, lkml
Subsystem:
hid core layer, roccat drivers, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Stefan Achatz, Linus Torvalds
From nobody Sat Oct 29 01:38:55 CEST 2011
From: Julia Lawall <redacted> To: Jiri Kosina <redacted> Cc: linux-input@vger.kernel.org,linux-kernel@vger.kernel.org Subject: [PATCH 3/5 v3] drivers/hid/hid-roccat.c: eliminate a null pointer dereference From: Julia Lawall <redacted> It is not possible to take the lock in device if device is NULL. The mutex_lock is thus moved after the NULL test. New error handling labels are added at the end to differentiate between the cases where different sets of locks should be unlocks, and between whether or not reader should be freed (only on error). The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r@ expression E, E1; identifier f; statement S1,S2,S3; @@ if (E == NULL) { ... when != if (E == NULL || ...) S1 else S2 when != E = E1 *E->f ... when any return ...; } else S3 // </smpl> Signed-off-by: Julia Lawall <redacted> --- Moved the error handling code back to the end. drivers/hid/hid-roccat.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 2596321..b685b04 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c@@ -163,27 +163,27 @@ static int roccat_open(struct inode *inode, struct file *file) device = devices[minor]; - mutex_lock(&device->readers_lock); - if (!device) { pr_emerg("roccat device with minor %d doesn't exist\n", minor); error = -ENODEV; - goto exit_err; + goto exit_err_devices; } + mutex_lock(&device->readers_lock); + if (!device->open++) { /* power on device on adding first reader */ error = hid_hw_power(device->hid, PM_HINT_FULLON); if (error < 0) { --device->open; - goto exit_err; + goto exit_err_readers; } error = hid_hw_open(device->hid); if (error < 0) { hid_hw_power(device->hid, PM_HINT_NORMAL); --device->open; - goto exit_err; + goto exit_err_readers; } }
@@ -194,13 +194,13 @@ static int roccat_open(struct inode *inode, struct file *file) list_add_tail(&reader->node, &device->readers); file->private_data = reader; -exit_unlock: +exit_err_readers: mutex_unlock(&device->readers_lock); +exit_err_devices: mutex_unlock(&devices_lock); + if (error) + kfree(reader); return error; -exit_err: - kfree(reader); - goto exit_unlock; } static int roccat_release(struct inode *inode, struct file *file)