2010-01-08 10:16:44

by Jiri Slaby

Subject: bonding: potential null dereference?

Hi,

I'm looking at Stanse errors and it detected a suspected behaviour in
bonding. In bond_slave_netdev_event, bond_dev is passed down to
netdev_priv, but due to 'if (bond_dev)' test later, it deduced it can be
also NULL.

I can see, that passing NULL to netdev_priv is OK nowadays, as it just
returns NULL + some offset. But what if this changes in the future?

I would bake a patch, but I don't know if bond_dev may be NULL at all
(i.e. superfluous test) or may not (wrong netdev_priv(bond_dev)).

static int (unsigned long event,
struct net_device *slave_dev)
{
struct net_device *bond_dev = slave_dev->master;
struct bonding *bond = netdev_priv(bond_dev);

switch (event) {
case NETDEV_UNREGISTER:
if (bond_dev) {
if (bond->setup_by_slave)
bond_release_and_destroy(bond_dev,
slave_dev);
else
bond_release(bond_dev, slave_dev);
}
break;

--
js

2010-01-08 17:46:22

by Jay Vosburgh

Subject: Re: bonding: potential null dereference?

Jiri Slaby <[email protected]> wrote:

>I'm looking at Stanse errors and it detected a suspected behaviour in
>bonding. In bond_slave_netdev_event, bond_dev is passed down to
>netdev_priv, but due to 'if (bond_dev)' test later, it deduced it can be
>also NULL.
>
>I can see, that passing NULL to netdev_priv is OK nowadays, as it just
>returns NULL + some offset. But what if this changes in the future?
>
>I would bake a patch, but I don't know if bond_dev may be NULL at all
>(i.e. superfluous test) or may not (wrong netdev_priv(bond_dev)).
>
>static int (unsigned long event,
> struct net_device *slave_dev)
>{
> struct net_device *bond_dev = slave_dev->master;
> struct bonding *bond = netdev_priv(bond_dev);
>
> switch (event) {
> case NETDEV_UNREGISTER:
> if (bond_dev) {
> if (bond->setup_by_slave)
> bond_release_and_destroy(bond_dev,
>slave_dev);
> else
> bond_release(bond_dev, slave_dev);
> }
> break;

I don't believe bond_dev will ever actually be NULL here,
because bond_netdev_event (the only caller of bond_slave_netdev_event)
checks that the device is, in fact, a bonding slave before the call.

Just from looking at the code, I don't see any issues with
removing the "if (bond_dev)" test.

-J

---
-Jay Vosburgh, IBM Linux Technology Center, [email protected]