Skip to content

Commit fe747d7

Browse files
rafaeljwij-intel
authored andcommitted
platform/x86: classmate-laptop: Add missing NULL pointer checks
In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it. For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward. Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur. For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward. Fix this by adding NULL pointer checks in all of the relevant places. Signed-off-by: Rafael J. Wysocki <[email protected]> Link: https://patch.msgid.link/[email protected] Reviewed-by: Ilpo Järvinen <[email protected]> Signed-off-by: Ilpo Järvinen <[email protected]>
1 parent 662c9cb commit fe747d7

1 file changed

Lines changed: 32 additions & 0 deletions

File tree

drivers/platform/x86/classmate-laptop.c

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev,
207207

208208
acpi = to_acpi_device(dev);
209209
inputdev = dev_get_drvdata(&acpi->dev);
210+
if (!inputdev)
211+
return -ENXIO;
212+
210213
accel = dev_get_drvdata(&inputdev->dev);
214+
if (!accel)
215+
return -ENXIO;
211216

212217
return sysfs_emit(buf, "%d\n", accel->sensitivity);
213218
}
@@ -224,7 +229,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev,
224229

225230
acpi = to_acpi_device(dev);
226231
inputdev = dev_get_drvdata(&acpi->dev);
232+
if (!inputdev)
233+
return -ENXIO;
234+
227235
accel = dev_get_drvdata(&inputdev->dev);
236+
if (!accel)
237+
return -ENXIO;
228238

229239
r = kstrtoul(buf, 0, &sensitivity);
230240
if (r)
@@ -256,7 +266,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev,
256266

257267
acpi = to_acpi_device(dev);
258268
inputdev = dev_get_drvdata(&acpi->dev);
269+
if (!inputdev)
270+
return -ENXIO;
271+
259272
accel = dev_get_drvdata(&inputdev->dev);
273+
if (!accel)
274+
return -ENXIO;
260275

261276
return sysfs_emit(buf, "%d\n", accel->g_select);
262277
}
@@ -273,7 +288,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev,
273288

274289
acpi = to_acpi_device(dev);
275290
inputdev = dev_get_drvdata(&acpi->dev);
291+
if (!inputdev)
292+
return -ENXIO;
293+
276294
accel = dev_get_drvdata(&inputdev->dev);
295+
if (!accel)
296+
return -ENXIO;
277297

278298
r = kstrtoul(buf, 0, &g_select);
279299
if (r)
@@ -302,6 +322,8 @@ static int cmpc_accel_open_v4(struct input_dev *input)
302322

303323
acpi = to_acpi_device(input->dev.parent);
304324
accel = dev_get_drvdata(&input->dev);
325+
if (!accel)
326+
return -ENXIO;
305327

306328
cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity);
307329
cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select);
@@ -549,7 +571,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev,
549571

550572
acpi = to_acpi_device(dev);
551573
inputdev = dev_get_drvdata(&acpi->dev);
574+
if (!inputdev)
575+
return -ENXIO;
576+
552577
accel = dev_get_drvdata(&inputdev->dev);
578+
if (!accel)
579+
return -ENXIO;
553580

554581
return sysfs_emit(buf, "%d\n", accel->sensitivity);
555582
}
@@ -566,7 +593,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev,
566593

567594
acpi = to_acpi_device(dev);
568595
inputdev = dev_get_drvdata(&acpi->dev);
596+
if (!inputdev)
597+
return -ENXIO;
598+
569599
accel = dev_get_drvdata(&inputdev->dev);
600+
if (!accel)
601+
return -ENXIO;
570602

571603
r = kstrtoul(buf, 0, &sensitivity);
572604
if (r)

0 commit comments

Comments
 (0)