Skip to contentSkip to conversation

staging: nvec: potential NULL dereference on error path

PATCH Superseded Dan Carpenter 2 participants 4 messages Nov 7, 2013

Subsystems (4)
Staging Kernel janitors Tegra architecture support Staging - NVIDIA compliant embedded controller interface (nvec)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 staging: nvec: potential NULL dereference on error path

We assume nvec->rx can be NULL earlier so I have added a check here as well.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/nvec/nvec.c +2 -1
index 3066ee2..c64e069 100644
@@ -681,7 +681,8 @@ static irqreturn_t nvec_interrupt(int irq, void *dev)
 			dev_err(nvec->dev,
 				"RX buffer overflow on %p: "
 				"Trying to write byte %u of %u\n",
-				nvec->rx, nvec->rx->pos, NVEC_MSG_SIZE);
+				nvec->rx, nvec->rx ? nvec->rx->pos : -1,
+				NVEC_MSG_SIZE);
 		break;
 	default:
 		nvec->state = 0;
#1 lore raw

(Replying to all now)

Quoted 10 lines · Dan Carpenter

We assume nvec->rx can be NULL earlier so I have added a check here as well.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/nvec/nvec.c +0 -0
index 3066ee2..c64e069 100644

drivers/staging/nvec/nvec.c static irqreturn_t nvec_interrupt(int irq, void *dev) · line 688

Quoted 9 lines
drivers/staging/nvec/nvec.c +2 -1
@@ -681,7 +681,8 @@ static irqreturn_t nvec_interrupt(int irq, void *dev)
                        dev_err(nvec->dev,
                                "RX buffer overflow on %p: "
                                "Trying to write byte %u of %u\n",
-                               nvec->rx, nvec->rx->pos, NVEC_MSG_SIZE);
+                               nvec->rx, nvec->rx ? nvec->rx->pos : -1,
+                               NVEC_MSG_SIZE);
                break;
        default:
                nvec->state = 0;

In the TX case, we print 0 if nvec->tx is NULL, so using -1 if nvec->rx is NULL would be inconsistent.

Signature · 3 lines
Julian Andres Klode  - Debian Developer, Ubuntu Member

See http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/.
author
#2 lore raw
Quoted 17 lines · Julian Andres Klode

(Replying to all now)

Quoted 14 lines · Dan Carpenter

We assume nvec->rx can be NULL earlier so I have added a check here as well.

Signed-off-by Dan Carpenter <[email protected]>
drivers/staging/nvec/nvec.c +0 -1
index 3066ee2..c64e069 100644
@@ -681,7 +681,8 @@ static irqreturn_t nvec_interrupt(int irq, void *dev)
                        dev_err(nvec->dev,
                                "RX buffer overflow on %p: "
                                "Trying to write byte %u of %u\n",
-                               nvec->rx, nvec->rx->pos, NVEC_MSG_SIZE);
Quoted 8 lines

drivers/staging/nvec/nvec.c static irqreturn_t nvec_interrupt(int irq, void *dev) · line 688

Quoted 5 lines
drivers/staging/nvec/nvec.c +2 -0
+                               nvec->rx, nvec->rx ? nvec->rx->pos : -1,
+                               NVEC_MSG_SIZE);
                break;
        default:
                nvec->state = 0;

In the TX case, we print 0 if nvec->tx is NULL, so using -1 if nvec->rx is NULL would be inconsistent.

Ok. I will resend.

regards,
dan carpenter

author
#3 lore raw

PATCH v2 1/1 staging: nvec: potential NULL dereference on error path

In reply to Julian Andres Klode

We assume nvec->rx can be NULL earlier so I have added a check here as well.

Signed-off-by Dan Carpenter <[email protected]>

---
v2: print 0 instead of -1.

drivers/staging/nvec/nvec.c +2 -1
index 3066ee2..c64e069 100644
@@ -681,7 +681,8 @@ static irqreturn_t nvec_interrupt(int irq, void *dev)
 			dev_err(nvec->dev,
 				"RX buffer overflow on %p: "
 				"Trying to write byte %u of %u\n",
-				nvec->rx, nvec->rx->pos, NVEC_MSG_SIZE);
+				nvec->rx, nvec->rx ? nvec->rx->pos : 0,
+				NVEC_MSG_SIZE);
 		break;
 	default:
 		nvec->state = 0;

_______________________________________________
devel mailing list
[email protected]
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel