Messages in this thread | | | Date | Thu, 18 Mar 2010 15:55:54 +0100 | From | Daniel Borkmann <> | Subject | Re: [PATCH 1/1] NET: netpoll, fix potential NULL ptr dereference |
| |
Matt Mackall wrote: > On Tue, 2010-03-16 at 18:22 +0100, Jiri Slaby wrote: >> On 03/16/2010 06:12 PM, Matt Mackall wrote: >>> I don't get it. The source of the branch tests for !ndev->npinfo and the >>> original destination of the branch also tests for !ndev->npinfo. I don't >>> see how it gets dereferenced. >> Let's look at more of the context: >> if (!ndev->npinfo) { >> npinfo = kmalloc(sizeof(*npinfo), GFP_KERNEL); >> if (!npinfo) { // npinfo is NULL >> err = -ENOMEM; >> goto release; >> } >> ... >> release: // npinfo is still NULL >> if (!ndev->npinfo) { // condition is the same (holds) >> // dereference below: vvvvvvvvvvvvvvv >> spin_lock_irqsave(&npinfo->rx_lock, flags); >> list_for_each_entry_safe(npe, tmp, &npinfo->rx_np, rx) { >> npe->dev = NULL; >> } >> spin_unlock_irqrestore(&npinfo->rx_lock, flags); >> >> kfree(npinfo); >> } > > Ok, you're correct, I read the second test backwards. > > Acked-by: Matt Mackall <mpm@selenic.com> >
Thanks for fixing this and sorry for not being responsive, obviously it sucks when you have a broken leg and German hospitals do not really have Internet access ... ;)
Thanks, Daniel
[unhandled content-type:application/pgp-signature] | |