staging: comedi: check s->async for poll(), read() and write()
authorIan Abbott <abbotti@mev.co.uk>
Wed, 27 Feb 2013 10:56:19 +0000 (10:56 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 3 Mar 2013 22:06:45 +0000 (06:06 +0800)
commit0685b5924819447dad0413312b508e68168a1ee2
tree6c28d6da87c5a8171da679408beab513cb5c4ffa
parente4cd1e4dba29c756272c2ee9d06b094b4319b90a
staging: comedi: check s->async for poll(), read() and write()

commit cc400e185c07c15a42d2635995f422de5b94b696 upstream.

Some low-level comedi drivers (incorrectly) point `dev->read_subdev` or
`dev->write_subdev` to a subdevice that does not support asynchronous
commands.  Comedi's poll(), read() and write() file operation handlers
assume these subdevices do support asynchronous commands.  In
particular, they assume `s->async` is valid (where `s` points to the
read or write subdevice), which it won't be if it has been set
incorrectly.  This can lead to a NULL pointer dereference.

Check `s->async` is non-NULL in `comedi_poll()`, `comedi_read()` and
`comedi_write()` to avoid the bug.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/comedi/comedi_fops.c