Skip to contentSkip to conversation

drivers/usb/gadget/ether.c: NULL dereference

DISCUSSION Adrian Bunk 2 participants 5 messages Nov 11, 2006 – Nov 12, 2006

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Adrian Bunk

author
#0 lore raw

The Coverity checker spotted the following NULL dereference of "skb" in drivers/usb/gadget/ether.c:

<-- snip -->

...
static int
rx_submit (struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)

{
        struct sk_buff          *skb;
        int                     retval = -ENOMEM;
...
        if ((skb = alloc_skb (size + NET_IP_ALIGN, gfp_flags)) == 0) {
                DEBUG (dev, "no rx skb\n");
                goto enomem;
        }
...
enomem:
                defer_kevent (dev, WORK_RX_MEMORY);
        if (retval) {
                DEBUG (dev, "rx submit --> %d\n", retval);
                dev_kfree_skb_any (skb);

...

<-- snip -->

cu
Adrian

Signature · 4 lines
       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed
#1 lore raw
Quoted 2 lines · Adrian Bunk

The Coverity checker spotted the following NULL dereference of "skb" in drivers/usb/gadget/ether.c:

I don't see such a dereference. As usual, free(NULL) is legit.

Is this another case of bogus reports from Coverity? I still need to revert a bug in the EHCI debug code caused by someone "fixing" it because Coverity doesn't understand unions...

Quoted 26 lines

<-- snip -->

...
static int
rx_submit (struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)

{
        struct sk_buff          *skb;
        int                     retval = -ENOMEM;
...
        if ((skb = alloc_skb (size + NET_IP_ALIGN, gfp_flags)) == 0) {
                DEBUG (dev, "no rx skb\n");
                goto enomem;
        }
...
enomem:
                defer_kevent (dev, WORK_RX_MEMORY);
        if (retval) {
                DEBUG (dev, "rx submit --> %d\n", retval);
                dev_kfree_skb_any (skb);

...

<-- snip -->

cu
Adrian

author
#2 lore raw
Quoted 6 lines · David Brownell
Quoted 2 lines · Adrian Bunk

The Coverity checker spotted the following NULL dereference of "skb" in drivers/usb/gadget/ether.c:

I don't see such a dereference. As usual, free(NULL) is legit.
...

void dev_kfree_skb_any(struct sk_buff *skb)

{
        if (in_irq() || irqs_disabled())
                dev_kfree_skb_irq(skb);
        else
                dev_kfree_skb(skb);
}

And the first thing dev_kfree_skb_irq() does is to dereference skb...

Quoted 21 lines
Quoted 21 lines

<-- snip -->

...
static int
rx_submit (struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)

{
        struct sk_buff          *skb;
        int                     retval = -ENOMEM;
...
        if ((skb = alloc_skb (size + NET_IP_ALIGN, gfp_flags)) == 0) {
                DEBUG (dev, "no rx skb\n");
                goto enomem;
        }
...
enomem:
                defer_kevent (dev, WORK_RX_MEMORY);
        if (retval) {
                DEBUG (dev, "rx submit --> %d\n", retval);
                dev_kfree_skb_any (skb);

...

Quoted 5 lines
Quoted 5 lines

<-- snip -->

cu
Adrian

cu
Adrian

Signature · 4 lines
       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed
#3 lore raw
Quoted 11 lines

void dev_kfree_skb_any(struct sk_buff *skb)

{
        if (in_irq() || irqs_disabled())
                dev_kfree_skb_irq(skb);
        else
                dev_kfree_skb(skb);
}
Quoted 1 line

And the first thing dev_kfree_skb_irq() does is to dereference skb...

Yet dev_kfree_skb() --> kfree_skb() starts with the standard idiom

	if (unlikely(!skb))
		return

Seems to me that the finger of blame is more appropriately pointed at either dev_kfree_skb_any() or dev_kfree_skb_irq() ...

- Dave

author
#4 lore raw
Quoted 13 lines · David Brownell
Quoted 11 lines

void dev_kfree_skb_any(struct sk_buff *skb)

{
        if (in_irq() || irqs_disabled())
                dev_kfree_skb_irq(skb);
        else
                dev_kfree_skb(skb);
}
Quoted 1 line

And the first thing dev_kfree_skb_irq() does is to dereference skb...

Quoted 8 lines

Yet dev_kfree_skb() --> kfree_skb() starts with the standard idiom

	if (unlikely(!skb))
		return

Seems to me that the finger of blame is more appropriately pointed at either dev_kfree_skb_any() or dev_kfree_skb_irq() ...
...

Adding the net maintainers to the Cc:
Is there any reason why dev_kfree_skb_irq() has no NULL check for "skb"?

cu
Adrian

Signature · 4 lines
       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed