Commit 82d12088 authored by Tianchu Chen's avatar Tianchu Chen Committed by Greg Kroah-Hartman
Browse files

char: applicom: fix NULL pointer dereference in ac_ioctl 



Discovered by Atuin - Automated Vulnerability Discovery Engine.

In ac_ioctl, the validation of IndexCard and the check for a valid
RamIO pointer are skipped when cmd is 6. However, the function
unconditionally executes readb(apbs[IndexCard].RamIO + VERS) at the
end.

If cmd is 6, IndexCard may reference a board that does not exist
(where RamIO is NULL), leading to a NULL pointer dereference.

Fix this by skipping the readb access when cmd is 6, as this
command is a global information query and does not target a specific
board context.

Signed-off-by: default avatarTianchu Chen <flynnnchen@tencent.com>
Acked-by: default avatarArnd Bergmann <arnd@arndb.de>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20251128155323.a786fde92ebb926cbe96fcb1@linux.dev


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent cbe1d77e

drivers/char/applicom.c

+4 −1
Original line number Diff line number Diff line
@@ -835,7 +835,10 @@ static long ac_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
		ret = -ENOTTY;

		break;

	}



	if (cmd != 6)

		Dummy = readb(apbs[IndexCard].RamIO + VERS);



	kfree(adgl);

	mutex_unlock(&ac_mutex);

	return ret;