Messages in this thread | | | Date | Thu, 5 Apr 2001 01:52:51 -0700 | From | Andy Chou <> | Subject | [CHECKER] 15 potential pointer dereference errors in 2.4.3 |
| |
I ran the null pointer dereference checker over 2.4.3 and it found the following 15 potential errors. As usual, the context given with each report may be misleading so you'll probably need to inspect the source. The checker tries to help by printing the function it thinks is returning NULL.
Also, I've run the checker over 2.2.19, and there were a bunch of issues but they would require some time and effort to inspect. Some of them are the same as issues reported for 2.4.x. Would it be useful to report these?
-Andy Chou
Files:
drivers/char/ip2main.c drivers/ide/ide-probe.c drivers/isdn/hisax/fsm.c drivers/mtd/ftl.c drivers/net/tokenring/tmsisa.c drivers/pcmcia/rsrc_mgr.c drivers/scsi/eata_dma.c drivers/scsi/sr.c fs/jffs/intrep.c fs/udf/partition.c fs/udf/super.c ipc/util.c
Reports:
--------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/drivers/char/ip2main.c:1041:ip2_init_board: ERROR:NULL:1030:1041: Using unknown ptr "pCh" illegally! set by 'kmalloc':1030
Start ---> kmalloc( sizeof(i2ChanStr) * nports, GFP_KERNEL ); if ( !i2InitChannels( pB, nports, pCh ) ) { printk(KERN_ERR "i2InitChannels failed: %d\n",pB->i2eError); } pB->i2eChannelPtr = &DevTable[portnum];
... DELETED 3 lines ...
for( box = 0; box < ABS_MAX_BOXES; ++box, portnum += ABS_BIGGEST_BOX ) { for( i = 0; i < ABS_BIGGEST_BOX; ++i ) { if ( pB->i2eChannelMap[box] & (1 << i) ) { DevTable[portnum + i] = pCh; Error ---> pCh->port_index = portnum + i; pCh++;
[BUG] /u2/acc/oses/linux/2.4.3/drivers/char/ip2main.c:1061:ip2_init_board: ERROR:NULL:1053:1061: Using unknown ptr "pCh" illegally! set by 'kmalloc':1053
Start ---> kmalloc ( sizeof (i2ChanStr) * nports, GFP_KERNEL ); pB->i2eChannelPtr = pCh; pB->i2eChannelCnt = nports; i2InitChannels ( pB, pB->i2eChannelCnt, pCh ); pB->i2eChannelPtr = &DevTable[IP2_PORTS_PER_BOARD * boardnum];
for( i = 0; i < pB->i2eChannelCnt; ++i ) { DevTable[IP2_PORTS_PER_BOARD * boardnum + i] = pCh; Error ---> pCh->port_index = (IP2_PORTS_PER_BOARD * boardnum) + i; pCh++; --------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/drivers/ide/ide-probe.c:66:do_identify: ERROR:NULL:60:66: Using unknown ptr "id" illegally! set by 'kmalloc':60
Start ---> id = drive->id = kmalloc (SECTOR_WORDS*4, GFP_ATOMIC); /* called with interrupts disabled! */ ide_input_data(drive, id, SECTOR_WORDS); /* read 512 bytes of id info */ ide__sti(); /* local CPU only */ ide_fix_driveid(id);
if (id->word156 == 0x4d42) { Error ---> printk("%s: drive->id->word156 == 0x%04x \n", drive->name, drive->id->word156); } ---------------------------------------------------------
[BUG] /u2/acc/oses/linux/2.4.3/drivers/isdn/hisax/fsm.c:34:FsmNew: ERROR:NULL:24:34: Using unknown ptr "jumpmatrix" illegally! set by 'kmalloc':24
Start ---> kmalloc(sizeof (FSMFNPTR) * fsm->state_count * fsm->event_count, GFP_KERNEL); memset(fsm->jumpmatrix, 0, sizeof (FSMFNPTR) * fsm->state_count * fsm->event_count);
for (i = 0; i < fncount; i++) if ((fnlist[i].state>=fsm->state_count) || (fnlist[i].event>=fsm->event_count)) { printk(KERN_ERR "FsmNew Error line %d st(%ld/%ld) ev(%ld/%ld)\n",
i,(long)fnlist[i].state,(long)fsm->state_count,
(long)fnlist[i].event,(long)fsm->event_count); } else fsm->jumpmatrix[fsm->state_count * fnlist[i].event + Error ---> fnlist[i].state] = (FSMFNPTR) fnlist[i].routine; } --------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/drivers/mtd/ftl.c:407:build_maps: ERROR:NULL:377:407: Using unknown ptr "VirtualBlockMap" illegally! set by 'vmalloc':377
Start ---> part->VirtualBlockMap = vmalloc(blocks * sizeof(u_int32_t)); memset(part->VirtualBlockMap, 0xff, blocks * sizeof(u_int32_t)); part->BlocksPerUnit = (1 << header.EraseUnitSize) >> header.BlockSize;
part->bam_cache = kmalloc(part->BlocksPerUnit * sizeof(u_int32_t),
... DELETED 22 lines ...
part->FreeTotal++; } else if ((BLOCK_TYPE(le32_to_cpu(part->bam_cache[j])) == BLOCK_DATA) && (BLOCK_NUMBER(le32_to_cpu(part->bam_cache[j])) < blocks))
part->VirtualBlockMap[BLOCK_NUMBER(le32_to_cpu(part->bam_cache[j]))] = Error ---> (i << header.EraseUnitSize) + (j << header.BlockSize); else if (BLOCK_DELETED(le32_to_cpu(part->bam_cache[j]))) --------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/drivers/net/tokenring/tmsisa.c:274:tms_isa_probe: ERROR:NULL:273:274: Using unknown ptr "card" illegally! set by 'kmalloc':273
Start ---> card = kmalloc(sizeof(struct tms_isa_card), GFP_KERNEL); Error ---> card->next = tms_isa_card_list; tms_isa_card_list = card; --------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/drivers/pcmcia/rsrc_mgr.c:199:do_io_probe: ERROR:NULL:191:199: Using unknown ptr "b" illegally! set by 'kmalloc':191
Start ---> b = kmalloc(256, GFP_KERNEL); memset(b, 0, 256); for (i = base, most = 0; i < base+num; i += 8) { if (check_io_resource(i, 8)) continue; hole = inb(i); for (j = 1; j < 8; j++) if (inb(i+j) != hole) break; Error ---> if ((j == 8) && (++b[hole] > b[most])) most = hole;
--------------------------------------------------------- [BUG] GEM this is bizarre /u2/acc/oses/linux/2.4.3/drivers/scsi/eata_dma.c:1249:register_HBA: ERROR:NULL:1139:1249: Using NULL ptr "buff" illegally! set by 'get_board_data':1139
Start ---> buff = get_board_data(base, gc->IRQ, gc->scsi_id[3]);
if (buff == NULL) { if (bustype == IS_EISA || bustype == IS_ISA) { bugs = bugs || BROKEN_INQUIRY;
... DELETED 102 lines ...
strncpy(hd->vendor, &buff[8], 8); hd->vendor[8] = 0; strncpy(hd->name, &buff[16], 17); hd->name[17] = 0; Error ---> hd->revision[0] = buff[32]; hd->revision[1] = buff[33]; --------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/drivers/scsi/sr.c:683:get_capabilities: ERROR:NULL:665:683: Using unknown ptr "buffer" illegally! set by 'scsi_malloc':665
Start ---> buffer = (unsigned char *) scsi_malloc(512); cmd[0] = MODE_SENSE; cmd[1] = (scsi_CDs[i].device->lun << 5) & 0xe0; cmd[2] = 0x2a; cmd[4] = 128;
... DELETED 10 lines ...
scsi_free(buffer, 512); printk("sr%i: scsi-1 drive\n", i); return; } Error ---> n = buffer[3] + 4; scsi_CDs[i].cdi.speed = ((buffer[n + 8] << 8) + buffer[n + 9]) / 176; --------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/fs/jffs/intrep.c:349:jffs_checksum_flash: ERROR:NULL:333:349: Using unknown ptr "read_buf" illegally! set by 'kmalloc':333
Start ---> read_buf = (__u8 *) kmalloc (sizeof(__u8) * 4096, GFP_KERNEL);
/* Loop until checksum done */ while (size) { /* Get amount of data to read */
... DELETED 8 lines ...
flash_safe_read(mtd, ptr, &read_buf[0], length);
/* Compute checksum */ for (i=0; i < length ; i++) Error ---> sum += read_buf[i];
--------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/fs/jffs/intrep.c:634:jffs_scan_flash: ERROR:NULL:608:634: Using unknown ptr "read_buf" illegally! set by 'kmalloc':608
Start ---> read_buf = (__u8 *) kmalloc (sizeof(__u8) * 4096, GFP_KERNEL);
/* Start the scan. */ while (pos < end) { deleted_file = 0;
... DELETED 18 lines ...
retlen &= ~3;
for (i=0 ; i < retlen ; i+=4, pos += 4) { if(*((__u32 *) &read_buf[i]) != Error ---> JFFS_EMPTY_BITMASK) break; ---------------------------------------------------------
[BUG] /u2/acc/oses/linux/2.4.3/fs/udf/partition.c:186:udf_fill_spartable: ERROR:NULL:164:186: Using unknown ptr "s_spar_map" illegally! set by 'kmalloc':164
Start ---> sdata->s_spar_map = kmalloc(mapsize, GFP_KERNEL); sdata->s_spar_remap.s_spar_remap32 = &sdata->s_spar_map[rtl]; memset(sdata->s_spar_map, 0xFF, mapsize); }
... DELETED 14 lines ...
} se = (SparingEntry *)&(bh->b_data[index]); index += sizeof(SparingEntry);
Error ---> if (sdata->s_spar_map[i] == 0xFFFFFFFF) sdata->s_spar_map[i] = le32_to_cpu(se->mappedLocation); --------------------------------------------------------- [BUG] hidden in macro /u2/acc/oses/linux/2.4.3/fs/udf/super.c:860:udf_load_logicalvol: ERROR:NULL:849:860: Using unknown ptr "s_partmaps" illegally! set by 'kmalloc':849
Start ---> UDF_SB_ALLOC_PARTMAPS(sb, UDF_SB_NUMPARTS(sb));
for (i=0,offset=0; i<UDF_SB_NUMPARTS(sb) && offset<le32_to_cpu(lvd->mapTableLength); i++,offset+=((struct GenericPartitionMap *)&(lvd->partitionMaps[offset]))->partitionMapLength)
... DELETED 3 lines ...
udf_debug("Partition (%d) type %d\n", i, type); if (type == 1) { struct GenericPartitionMap1 *gpm1 = (struct GenericPartitionMap1 *)&(lvd->partitionMaps[offset]); Error ---> UDF_SB_PARTTYPE(sb,i) = UDF_TYPE1_MAP15; UDF_SB_PARTVSN(sb,i) = le16_to_cpu(gpm1->volSeqNum);
--------------------------------------------------------- [BUG] /u2/acc/oses/linux/2.4.3/fs/udf/super.c:1186:udf_load_partition: ERROR:NULL:1183:1186: Using unknown ptr "bh" illegally! set by 'bread':1183
Start ---> bh = bread(sb->s_dev, pos, sb->s_blocksize);
UDF_SB_TYPEVIRT(sb,i).s_start_offset = le16_to_cpu(((struct VirtualAllocationTable20 *)bh->b_data + udf_ext0_offset(UDF_SB_VAT(sb)))->lengthHeader) + Error --->
udf_ext0_offset(UDF_SB_VAT(sb));
UDF_SB_TYPEVIRT(sb,i).s_num_entries = (UDF_SB_VAT(sb)->i_size - --------------------------------------------------------- [BUG] oops. /u2/acc/oses/linux/2.4.3/ipc/util.c:79:ipc_init_ids: ERROR:NULL:71:79: Using NULL ptr "entries" illegally! set by 'ipc_alloc':71
Start ---> ids->entries = ipc_alloc(sizeof(struct ipc_id)*size);
if(ids->entries == NULL) { printk(KERN_ERR "ipc_init_ids() failed, ipc service disabled.\n"); ids->size = 0; } ids->ary = SPIN_LOCK_UNLOCKED; for(i=0;i<size;i++) Error ---> ids->entries[i].p = NULL; } ---------------------------------------------------------
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |