diff options
| author | Ian Abbott <abbotti@mev.co.uk> | 2026-06-18 11:09:15 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-17 14:55:16 +0200 |
| commit | 956e8478261a575d1e87490f2e5db1788b8c209d (patch) | |
| tree | faa5948d8fdcbea76c4428ec549b820721b6ba2c /drivers | |
| parent | 4fdac5090ce3616283216d9a1d2b9664e8e20747 (diff) | |
| download | linux-next-956e8478261a575d1e87490f2e5db1788b8c209d.tar.gz linux-next-956e8478261a575d1e87490f2e5db1788b8c209d.zip | |
comedi: pcm818: Fix sanity check in interrupt handler
The driver requests an interrupt handler for the device before it is
fully set up.
For safety, the interrupt handler checks the dev->attached flag to
ensure the device is fully set up, but it currently does that after
dereferencing the dev->read_dev pointer which may be NULL if
dev->attached is false. Move the check to avoid the possible null
pointer dereference.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260618102949.26607-9-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/comedi/drivers/pcl818.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/comedi/drivers/pcl818.c b/drivers/comedi/drivers/pcl818.c index aa775a024fc7..89f32c493caa 100644 --- a/drivers/comedi/drivers/pcl818.c +++ b/drivers/comedi/drivers/pcl818.c @@ -534,13 +534,14 @@ static irqreturn_t pcl818_interrupt(int irq, void *d) struct comedi_device *dev = d; struct pcl818_private *devpriv = dev->private; struct comedi_subdevice *s = dev->read_subdev; - struct comedi_cmd *cmd = &s->async->cmd; + struct comedi_cmd *cmd; if (!dev->attached || !devpriv->ai_cmd_running) { pcl818_ai_clear_eoc(dev); return IRQ_HANDLED; } + cmd = &s->async->cmd; if (devpriv->ai_cmd_canceled) { /* * The cleanup from ai_cancel() has been delayed |