Skip to contentSkip to conversation

Fix a potential NULL pointer dereference in uli526x_interrupt() in drivers/net/tulip/uli526x.c

PATCH In review Micah Gruber 4 participants 5 messages Sep 4, 2007 – Sep 13, 2007

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Micah Gruber

author
#0 lore raw

PATCH 1/1 Fix a potential NULL pointer dereference in uli526x_interrupt() in drivers/net/tulip/uli526x.c

This patch fixes a potential null dereference bug where we dereference dev before a null check. This patch simply moves the dereferencing after the null check.

Signed-off-by Micah Gruber <[email protected]>

---

drivers/net/tulip/uli526x.c +3 -1
@@ -663,7 +663,7 @@
 {
 	struct net_device *dev = dev_id;
 	struct uli526x_board_info *db = netdev_priv(dev);
-	unsigned long ioaddr = dev->base_addr;
+	unsigned long ioaddr;
 	unsigned long flags;
 
 	if (!dev) {

@@ -671,6 +671,8 @@
 		return IRQ_NONE;
 	}
 
+	ioaddr = dev->base_addr;
+
 	spin_lock_irqsave(&db->lock, flags);
 	outl(0, ioaddr + DCR7);
#1 lore raw
Quoted 17 lines · Micah Gruber

This patch fixes a potential null dereference bug where we dereference dev before a null check. This patch simply moves the dereferencing after the null check.

Signed-off-by Micah Gruber <[email protected]>

---

drivers/net/tulip/uli526x.c +1 -1
@@ -663,7 +663,7 @@
 {
 	struct net_device *dev = dev_id;
 	struct uli526x_board_info *db = netdev_priv(dev);
-	unsigned long ioaddr = dev->base_addr;
+	unsigned long ioaddr;
 	unsigned long flags;
 
 	if (!dev) {

drivers/net/tulip/uli526x.c line 675

Quoted 5 lines
drivers/net/tulip/uli526x.c +2 -0
@@ -671,6 +671,8 @@
 		return IRQ_NONE;
 	}
 
+	ioaddr = dev->base_addr;
+

as satyam noted, just remove the !dev test

#2 lore raw
In reply to Micah Gruber
Quoted 17 lines · On Tue, 04 Sep 2007 16:14:06 +0800 Micah Gruber <[email protected]> wrote:

This patch fixes a potential null dereference bug where we dereference dev before a null check. This patch simply moves the dereferencing after the null check.

Signed-off-by Micah Gruber <[email protected]>

---

drivers/net/tulip/uli526x.c +1 -1
@@ -663,7 +663,7 @@
 {
 	struct net_device *dev = dev_id;
 	struct uli526x_board_info *db = netdev_priv(dev);
-	unsigned long ioaddr = dev->base_addr;
+	unsigned long ioaddr;
 	unsigned long flags;
 
 	if (!dev) {

drivers/net/tulip/uli526x.c line 678

Quoted 8 lines
drivers/net/tulip/uli526x.c +2 -0
@@ -671,6 +671,8 @@
 		return IRQ_NONE;
 	}
 
+	ioaddr = dev->base_addr;
+
 	spin_lock_irqsave(&db->lock, flags);
 	outl(0, ioaddr + DCR7);

I suspect the fix we want is:

drivers/net/tulip/uli526x.c renamed from drivers/net/tulip/uli526x.c~fix-a-potential-null-pointer-dereference-in-uli526x_interrupt +0 -5
@@ -666,11 +666,6 @@ static irqreturn_t uli526x_interrupt(int
 	unsigned long ioaddr = dev->base_addr;
 	unsigned long flags;
 
-	if (!dev) {
-		ULI526X_DBUG(1, "uli526x_interrupt() without DEVICE arg", 0);
-		return IRQ_NONE;
-	}
-
 	spin_lock_irqsave(&db->lock, flags);
 	outl(0, ioaddr + DCR7);

_

#3 lore raw
Quoted 2 lines · Andrew Morton

I suspect the fix we want is:

ack. The trend seems to be to avoid this redundant check in the interrupt handler.

#4 lore raw
In reply to Andrew Morton

drivers/net/tulip/uli526x.c static irqreturn_t uli526x_interrupt(int · line 673

Quoted 11 lines · Andrew Morton
drivers/net/tulip/uli526x.c renamed from drivers/net/tulip/uli526x.c~fix-a-potential-null-pointer-dereference-in-uli526x_interrupt +0 -5
@@ -666,11 +666,6 @@ static irqreturn_t uli526x_interrupt(int
 	unsigned long ioaddr = dev->base_addr;
 	unsigned long flags;
 
-	if (!dev) {
-		ULI526X_DBUG(1, "uli526x_interrupt() without DEVICE arg", 0);
-		return IRQ_NONE;
-	}
-

correct / ACK