ni_670x: Fix possible invalid pointer dereference in ni_670x_detach()

In ni_670x_detach(), dev->subdevices will be NULL if the call to
alloc_subdevices() failed in ni_670x_attach(), so don't dereference it
until the pointer has been checked.

Spotted by H Hartley Sweeten in the "staging" sources, but used a
different check due to difference in behavior of alloc_subdevices() on
error between the two versions.

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>

diff --git a/comedi/drivers/ni_670x.c b/comedi/drivers/ni_670x.c
index 65d22bd68d2e700232d96418f07c9874827248fa..153856e6c5c5da3d61c4264c9a0d06c3bfbc7589 100644 (file)
--- a/comedi/drivers/ni_670x.c
+++ b/comedi/drivers/ni_670x.c
@@ -206,7 +206,7 @@ static int ni_670x_detach(comedi_device * dev)
 {
        printk("comedi%d: ni_670x: remove\n", dev->minor);
 
-       if (dev->subdevices[0].range_table_list) {
+       if (dev->subdevices && dev->subdevices[0].range_table_list) {
                kfree(dev->subdevices[0].range_table_list);
        }
        if (dev->private && devpriv->mite)