diff options
| author | Johan Hovold <johan@hovoldconsulting.com> | 2015-03-27 12:45:41 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <greg@kroah.com> | 2015-03-30 15:17:37 +0200 |
| commit | 1842dd8b7bc7d713d3c252a501411b5009b3987d (patch) | |
| tree | 424f1f6c6fee9a1d9fa72a4f57c8b11dbe9b1bca /drivers/staging/greybus/gpio.c | |
| parent | 0150bd7f23618eb4feb293f4db007833555a887f (diff) | |
| download | op-kernel-dev-1842dd8b7bc7d713d3c252a501411b5009b3987d.zip op-kernel-dev-1842dd8b7bc7d713d3c252a501411b5009b3987d.tar.gz | |
greybus: gpio: fix null-deref on short irq requests
Make sure to verify the length of incoming requests before trying to
parse the request buffer, which can even be NULL on empty requests.
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Diffstat (limited to 'drivers/staging/greybus/gpio.c')
| -rw-r--r-- | drivers/staging/greybus/gpio.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/greybus/gpio.c b/drivers/staging/greybus/gpio.c index 2bac28e..7dc675d 100644 --- a/drivers/staging/greybus/gpio.c +++ b/drivers/staging/greybus/gpio.c @@ -413,6 +413,12 @@ static void gb_gpio_request_recv(u8 type, struct gb_operation *op) ggc = connection->private; request = op->request; + + if (request->payload_size < sizeof(*event)) { + dev_err(ggc->chip.dev, "short event received\n"); + return; + } + event = request->payload; if (event->which > ggc->line_max) { dev_err(ggc->chip.dev, "invalid hw irq: %d\n", event->which); |
