2007-08-14 21:27:43

by Adrian Bunk

Subject: [2.6 patch] dvb_net_ule(): fix check-after-use

The Coverity checker spotted that we'd have already oops'ed if "dev"
was NULL.

Signed-off-by: Adrian Bunk <[email protected]>

---
--- linux-2.6.23-rc1-mm2/drivers/media/dvb/dvb-core/dvb_net.c.old 2007-08-08 06:17:19.000000000 +0200
+++ linux-2.6.23-rc1-mm2/drivers/media/dvb/dvb-core/dvb_net.c 2007-08-08 06:17:35.000000000 +0200
@@ -346,33 +346,28 @@
static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
{
struct dvb_net_priv *priv = dev->priv;
unsigned long skipped = 0L;
const u8 *ts, *ts_end, *from_where = NULL;
u8 ts_remain = 0, how_much = 0, new_ts = 1;
struct ethhdr *ethh = NULL;

#ifdef ULE_DEBUG
/* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
static unsigned char ule_hist[100*TS_SZ];
static unsigned char *ule_where = ule_hist, ule_dump = 0;
#endif

- if (dev == NULL) {
- printk( KERN_ERR "NO netdev struct!\n" );
- return;
- }
-
/* For all TS cells in current buffer.
* Appearently, we are called for every single TS cell.
*/
for (ts = buf, ts_end = buf + buf_len; ts < ts_end; /* no default incr. */ ) {

if (new_ts) {
/* We are about to process a new TS cell. */

#ifdef ULE_DEBUG
if (ule_where >= &ule_hist[100*TS_SZ]) ule_where = ule_hist;
memcpy( ule_where, ts, TS_SZ );
if (ule_dump) {
hexdump( ule_where, TS_SZ );
ule_dump = 0;

2007-08-16 07:20:40

by Manu Abraham

Subject: Re: [v4l-dvb-maintainer] [2.6 patch] dvb_net_ule(): fix check-after-use

Adrian Bunk wrote:
> The Coverity checker spotted that we'd have already oops'ed if "dev"
> was NULL.
>
> Signed-off-by: Adrian Bunk <[email protected]>
>
> ---
> --- linux-2.6.23-rc1-mm2/drivers/media/dvb/dvb-core/dvb_net.c.old 2007-08-08 06:17:19.000000000 +0200
> +++ linux-2.6.23-rc1-mm2/drivers/media/dvb/dvb-core/dvb_net.c 2007-08-08 06:17:35.000000000 +0200
> @@ -346,33 +346,28 @@
> static void dvb_net_ule( struct net_device *dev, const u8 *buf, size_t buf_len )
> {
> struct dvb_net_priv *priv = dev->priv;
> unsigned long skipped = 0L;
> const u8 *ts, *ts_end, *from_where = NULL;
> u8 ts_remain = 0, how_much = 0, new_ts = 1;
> struct ethhdr *ethh = NULL;
>
> #ifdef ULE_DEBUG
> /* The code inside ULE_DEBUG keeps a history of the last 100 TS cells processed. */
> static unsigned char ule_hist[100*TS_SZ];
> static unsigned char *ule_where = ule_hist, ule_dump = 0;
> #endif
>
> - if (dev == NULL) {
> - printk( KERN_ERR "NO netdev struct!\n" );
> - return;
> - }
> -
> /* For all TS cells in current buffer.
> * Appearently, we are called for every single TS cell.
> */
> for (ts = buf, ts_end = buf + buf_len; ts < ts_end; /* no default incr. */ ) {
>
> if (new_ts) {
> /* We are about to process a new TS cell. */
>
> #ifdef ULE_DEBUG
> if (ule_where >= &ule_hist[100*TS_SZ]) ule_where = ule_hist;
> memcpy( ule_where, ts, TS_SZ );
> if (ule_dump) {
> hexdump( ule_where, TS_SZ );
> ule_dump = 0;
>
>

Signed-off-by: Manu Abraham <[email protected]>