From: Ian Abbott Date: Wed, 3 Oct 2012 15:25:16 +0000 (+0100) Subject: staging: comedi: amplc_dio200: fix possible NULL deref during detach X-Git-Tag: v3.7-rc3~13^2~17 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dfb2540e91e1f63765bc3ff497ad0b714d774261;p=pandora-kernel.git staging: comedi: amplc_dio200: fix possible NULL deref during detach `dio200_detach()` is called by the comedi core to clean up if either `dio200_attach()` or `dio200_attach_pci()` return an error. It assigns `thisboard` to the return value of `comedi_board(dev)` and assumes it is non-null. In the case of a previous call to `dio200_attach()` it won't be `NULL` because the comedi core will have pointed it to one of the elements of `dio200_boards[]`, but in the case of a previous call to `dio200_attach_pci()` it could be `NULL`, leading to a null pointer dereference. Check that `thisboard` is valid at the top of `dio200_detach()` and return early if it is `NULL`. This is okay because the only other thing that could have been allocated is `dev->private` and that is freed by the comedi core, not by this function. Cc: # 3.6.x Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed