lkml.org 
[lkml]   [2010]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 1/1] NET: netpoll, fix potential NULL ptr dereference
From
Date
On Tue, 2010-03-16 at 18:22 +0100, Jiri Slaby wrote:
> On 03/16/2010 06:12 PM, Matt Mackall wrote:
> > I don't get it. The source of the branch tests for !ndev->npinfo and the
> > original destination of the branch also tests for !ndev->npinfo. I don't
> > see how it gets dereferenced.
>
> Let's look at more of the context:
> if (!ndev->npinfo) {
> npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL);
> if (!npinfo) { // npinfo is NULL
> err = -ENOMEM;
> goto release;
> }
> ...
> release: // npinfo is still NULL
> if (!ndev->npinfo) { // condition is the same (holds)
> // dereference below: vvvvvvvvvvvvvvv
> spin_lock_irqsave(&npinfo->rx_lock, flags);
> list_for_each_entry_safe(npe, tmp, &npinfo->rx_np, rx) {
> npe->dev = NULL;
> }
> spin_unlock_irqrestore(&npinfo->rx_lock, flags);
>
> kfree(npinfo);
> }

Ok, you're correct, I read the second test backwards.

Acked-by: Matt Mackall <mpm@selenic.com>

--
http://selenic.com : development and support for Mercurial and Linux




\
 
 \ /
  Last update: 2010-03-16 18:59    [W:0.057 / U:0.340 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site