lkml.org 
[lkml]   [2006]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: softmac possible null deref [was: Complete report of Null dereference errors in kernel 2.6.17.1]
From
Hi,

On Mon, Jul 24, 2006 at 05:00:08PM -0700, Thomas Dillig wrote:
> At least in 2.6.17.1, the function looks as follows:
>
> /* Create an rts/cts frame */
> 445 static u32
> 446 ieee80211softmac_rts_cts(struct ieee80211_hdr_2addr **pkt,
> 447 struct ieee80211softmac_device *mac, struct ieee80211softmac_network *net,
> 448 u32 type)
> 449 {
> 450 /* Allocate Packet */
> 451 (*pkt) = kmalloc(IEEE80211_2ADDR_LEN, GFP_ATOMIC); 452 memset(*pkt, 0, IEEE80211_2ADDR_LEN); //*pkt is not checked for
> NULL
> 453 if((*pkt) == NULL) //*pkt is checked for NULL
> 454 return 0;
> 455 ieee80211softmac_hdr_2addr(mac, (*pkt), type, net->bssid);
> 456 return IEEE80211_2ADDR_LEN;
> 457 }

The function does not exist anymore in my 2.6.18-rc2-gabb5a5c tree.

> The report is just trying to say that "*pkt" is dereferenced inside the call to "memset" and checked for being null one line later.

This is really odd :) One should have used kzalloc() anyway.

Hannes
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-07-25 08:25    [W:0.097 / U:0.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site