[3.8.y.z extended stable] Patch "staging: comedi: pcmuio: fix possible NULL deref on detach" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    staging: comedi: pcmuio: fix possible NULL deref on detach

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.15.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From d9fd5fca2ff6404d897ef9c4089baf6c07aae9aa Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti at mev.co.uk>
Date: Thu, 12 Dec 2013 13:20:50 +0000
Subject: staging: comedi: pcmuio: fix possible NULL deref on detach

commit 2fd2bdfccae61efe18f6b92b6a45fbf936d75b48 upstream.

pcmuio_detach() is called by the comedi core even if pcmuio_attach()
returned an error, so `dev->private` might be `NULL`.  Check for that
before dereferencing it.

Also, as pointed out by Dan Carpenter, there is no need to check the
pointer passed to `kfree()` is non-NULL, so remove that check.

Signed-off-by: Ian Abbott <abbotti at mev.co.uk>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 drivers/staging/comedi/drivers/pcmuio.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/comedi/drivers/pcmuio.c b/drivers/staging/comedi/drivers/pcmuio.c
index 31ea20c..2c44647 100644
--- a/drivers/staging/comedi/drivers/pcmuio.c
+++ b/drivers/staging/comedi/drivers/pcmuio.c
@@ -908,12 +908,13 @@ static void pcmuio_detach(struct comedi_device *dev)

 	if (dev->iobase)
 		release_region(dev->iobase, ASIC_IOSIZE * board->num_asics);
-	for (i = 0; i < MAX_ASICS; ++i) {
-		if (devpriv->asics[i].irq)
-			free_irq(devpriv->asics[i].irq, dev);
-	}
-	if (devpriv && devpriv->sprivs)
+	if (devpriv) {
+		for (i = 0; i < MAX_ASICS; ++i) {
+			if (devpriv->asics[i].irq)
+				free_irq(devpriv->asics[i].irq, dev);
+		}
 		kfree(devpriv->sprivs);
+	}
 }

 static const struct pcmuio_board pcmuio_boards[] = {
--
1.8.3.2