Messages in this thread | | | Subject | Re: [PATCH 1/1] NET: netpoll, fix potential NULL ptr dereference | From | Matt Mackall <> | Date | Tue, 16 Mar 2010 12:56:00 -0500 |
| |
On Tue, 2010-03-16 at 18:22 +0100, Jiri Slaby wrote: > On 03/16/2010 06:12 PM, Matt Mackall wrote: > > I don't get it. The source of the branch tests for !ndev->npinfo and the > > original destination of the branch also tests for !ndev->npinfo. I don't > > see how it gets dereferenced. > > Let's look at more of the context: > if (!ndev->npinfo) { > npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL); > if (!npinfo) { // npinfo is NULL > err = -ENOMEM; > goto release; > } > ... > release: // npinfo is still NULL > if (!ndev->npinfo) { // condition is the same (holds) > // dereference below: vvvvvvvvvvvvvvv > spin_lock_irqsave(&npinfo->rx_lock, flags); > list_for_each_entry_safe(npe, tmp, &npinfo->rx_np, rx) { > npe->dev = NULL; > } > spin_unlock_irqrestore(&npinfo->rx_lock, flags); > > kfree(npinfo); > }
Ok, you're correct, I read the second test backwards.
Acked-by: Matt Mackall <mpm@selenic.com>
-- http://selenic.com : development and support for Mercurial and Linux
| |