Skip to contentSkip to conversation

[2.6.22] Fix a potential NULL pointer dereference in write_bulk_callback() in drivers/net/usb/pegasus.c

PATCH In review Micah Gruber 3 participants 3 messages Jul 23, 2007 – Jul 30, 2007

Subsystems (4)
Networking Network drivers USB networking drivers USB pegasus driver
lore
Share & tools
lore

Micah Gruber

author
#0 lore raw

PATCH 1/1 [2.6.22] Fix a potential NULL pointer dereference in write_bulk_callback() in drivers/net/usb/pegasus.c

This patch fixes a potential null dereference bug where we dereference pegasus before a null check. This patch simply moves the dereferencing after the null check.

Signed-off-by Micah Gruber <[email protected]>

---

drivers/net/usb/pegasus.c +0 -0
@@ -768,11 +768,13 @@

static void write_bulk_callback(struct urb *urb)

{
       pegasus_t *pegasus = urb->context;

- struct net_device *net = pegasus->net;
+ struct net_device *net;

       if (!pegasus)
               return;

+ net = pegasus->net;
+

       if (!netif_device_present(net) || !netif_running(net))
               return;
maintainer
#1 lore raw

ACK :-)

cheers,
Petko

Quoted 23 lines · Micah Gruber

This patch fixes a potential null dereference bug where we dereference pegasus before a null check. This patch simply moves the dereferencing after the null check.

Signed-off-by Micah Gruber <[email protected]>

---

drivers/net/usb/pegasus.c +3 -1
@@ -768,11 +768,13 @@
 static void write_bulk_callback(struct urb *urb)
 {
      pegasus_t *pegasus = urb->context;
-       struct net_device *net = pegasus->net;
+       struct net_device *net;
 
      if (!pegasus)
              return;
 
+       net = pegasus->net;
+
      if (!netif_device_present(net) || !netif_running(net))
              return;
#2 lore raw
In reply to Micah Gruber
Quoted 10 lines · Micah Gruber

This patch fixes a potential null dereference bug where we dereference pegasus before a null check. This patch simply moves the dereferencing after the null check.

Signed-off-by Micah Gruber <[email protected]>

---

drivers/net/usb/pegasus.c +0 -0
@@ -768,11 +768,13 @@
 static void write_bulk_callback(struct urb *urb)

drivers/net/usb/pegasus.c line 777

Quoted 10 lines
drivers/net/usb/pegasus.c +3 -1
 {
       pegasus_t *pegasus = urb->context;
-       struct net_device *net = pegasus->net;
+       struct net_device *net;
 
       if (!pegasus)
               return;
 
+       net = pegasus->net;
+

applied (manually)