2006-10-05 10:01:34

by Eric Sesterhenn

Subject: [Patch] Dereference in drivers/usb/misc/adutux.c

hi,

in two of the error cases, dev is still NULL,
and we dereference it. Spotted by coverity (cid#1428, 1429)

Signed-off-by: Eric Sesterhenn <[email protected]>

--- linux-2.6.19-rc1/drivers/usb/misc/adutux.c.orig 2006-10-05 11:57:52.000000000 +0200
+++ linux-2.6.19-rc1/drivers/usb/misc/adutux.c 2006-10-05 11:58:19.000000000 +0200
@@ -370,7 +370,8 @@ static int adu_release(struct inode *ino
retval = adu_release_internal(dev);

exit:
- up(&dev->sem);
+ if(dev)
+ up(&dev->sem);
dbg(2," %s : leave, return value %d", __FUNCTION__, retval);
return retval;
}

2006-10-05 15:20:09

by Randy Dunlap

Subject: Re: [Patch] Dereference in drivers/usb/misc/adutux.c

On Thu, 05 Oct 2006 12:01:29 +0200 Eric Sesterhenn wrote:

> hi,
>
> in two of the error cases, dev is still NULL,
> and we dereference it. Spotted by coverity (cid#1428, 1429)
>
> Signed-off-by: Eric Sesterhenn <[email protected]>
>
> --- linux-2.6.19-rc1/drivers/usb/misc/adutux.c.orig 2006-10-05 11:57:52.000000000 +0200
> +++ linux-2.6.19-rc1/drivers/usb/misc/adutux.c 2006-10-05 11:58:19.000000000 +0200
> @@ -370,7 +370,8 @@ static int adu_release(struct inode *ino
> retval = adu_release_internal(dev);
>
> exit:
> - up(&dev->sem);
> + if(dev)
> + up(&dev->sem);
> dbg(2," %s : leave, return value %d", __FUNCTION__, retval);
> return retval;
> }

if (dev)

space after if, for, while, etc. No space after function names.

---
~Randy

2006-10-05 22:09:33

by Eric Sesterhenn

Subject: Re: [Patch] Dereference in drivers/usb/misc/adutux.c

hi,

> > in two of the error cases, dev is still NULL,
> > and we dereference it. Spotted by coverity (cid#1428, 1429)
> >
> space after if, for, while, etc. No space after function names.

updated patch below.

Signed-off-by: Eric Sesterhenn <[email protected]>

--- linux-2.6.19-rc1/drivers/usb/misc/adutux.c.orig 2006-10-05 17:34:45.000000000 +0200
+++ linux-2.6.19-rc1/drivers/usb/misc/adutux.c 2006-10-05 17:34:53.000000000 +0200
@@ -370,7 +370,8 @@ static int adu_release(struct inode *ino
retval = adu_release_internal(dev);

exit:
- up(&dev->sem);
+ if (dev)
+ up(&dev->sem);
dbg(2," %s : leave, return value %d", __FUNCTION__, retval);
return retval;
}