[PATCH] mtd: ubi: avoid NULL pointer dereference in ubi_get_device

[PATCH] mtd: ubi: avoid NULL pointer dereference in ubi_get_device

[Philipp Zabel]

If the ubidetach command is given a number that passes the range check
in ubi_detach_mtd_dev, but at which index the ubi_devices array contains
a NULL pointer, ubi_get_device tries to dereference this NULL pointer
to increment the ubi device reference count.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
---
 drivers/mtd/ubi/build.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index da21f69..b908fcd 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -104,6 +104,8 @@ struct ubi_device *ubi_get_device(int ubi_num)
 	struct ubi_device *ubi;
 
 	ubi = ubi_devices[ubi_num];
+	if (!ubi)
+		return NULL;
 
 	ubi->ref_count++;
 
-- 
1.9.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] mtd: ubi: avoid NULL pointer dereference in ubi_get_device

[Sascha Hauer]

On Wed, Mar 19, 2014 at 02:25:02PM +0100, Philipp Zabel wrote:
> If the ubidetach command is given a number that passes the range check
> in ubi_detach_mtd_dev, but at which index the ubi_devices array contains
> a NULL pointer, ubi_get_device tries to dereference this NULL pointer
> to increment the ubi device reference count.
> 
> Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>

Applied, thanks

Sascha

> ---
>  drivers/mtd/ubi/build.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
> index da21f69..b908fcd 100644
> --- a/drivers/mtd/ubi/build.c
> +++ b/drivers/mtd/ubi/build.c
> @@ -104,6 +104,8 @@ struct ubi_device *ubi_get_device(int ubi_num)
>  	struct ubi_device *ubi;
>  
>  	ubi = ubi_devices[ubi_num];
> +	if (!ubi)
> +		return NULL;
>  
>  	ubi->ref_count++;
>  
> -- 
> 1.9.0
> 
> 
> _______________________________________________
> barebox mailing list
> barebox@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/barebox
> 

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox