lkml.org 
[lkml]   [2008]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 4/6] drivers/net/fs_enet: remove null pointer dereference
From: Julia Lawall <julia@diku.dk>

The following code appears in the function fs_init_instance in the file drivers/net/fs_enet/fs_enet-main.c.

if (fep->ops == NULL) {
printk(KERN_ERR DRV_MODULE_NAME
": %s No matching ops found (%d).\n",
ndev->name, fpi->fs_no);
err = -EINVAL;
goto err;
}

This code implies that at the point of err, fep->ops can be NULL, so an
extra test is needed before dereferencing this value.


This problem was found using the following semantic match
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@@
expression E, E1;
identifier f;
statement S1,S2,S3;
@@

* if (E == NULL)
{
... when != if (E == NULL) S1 else S2
when != E = E1
* E->f
... when any
return ...;
}
else S3
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>

---

diff -u -p a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
--- a/drivers/net/fs_enet/fs_enet-main.c 2008-04-27 11:41:11.000000000 +0200
+++ b/drivers/net/fs_enet/fs_enet-main.c 2008-05-12 09:41:52.000000000 +0200
@@ -1093,7 +1093,7 @@ err:
if (registered)
unregister_netdev(ndev);

- if (fep != NULL) {
+ if (fep && fep->ops) {
(*fep->ops->free_bd)(ndev);
(*fep->ops->cleanup_data)(ndev);
}

\
 
 \ /
  Last update: 2008-05-12 15:41    [W:0.041 / U:0.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site