2009-12-15 13:49:51

by Alexander Strakh

[permalink] [raw]
Subject: BUG null dereference in driver ./drivers/isdn/icn/icn.c

KERNEL_VERSION: 2.6.32
SUBJECT: null dereference after check
DESCRIBE:
In driver ./drivers/isdn/icn/icn.c in function icn_addcard:

1. If in line 1580 card2 = NULL then we goto line 1581
2. In line 1581 we have null dereference because printk called with card2-
>interface.id in third parameter.

1580 if (!(card2 = icn_initcard(port, id2))) {
1581 printk(KERN_INFO
1582 "icn: (%s) half ICN-4B, port 0x%x added\n",
1583 card2->interface.id, port);
1584 return 0;
1585 }

Found by Linux Device Drivers Verification Project (Svace Detector)


Subject: Re: BUG null dereference in driver ./drivers/isdn/icn/icn.c

On Tuesday 15 December 2009 06:55:06 pm Alexander Strakh wrote:
> KERNEL_VERSION: 2.6.32
> SUBJECT: null dereference after check
> DESCRIBE:
> In driver ./drivers/isdn/icn/icn.c in function icn_addcard:
>
> 1. If in line 1580 card2 = NULL then we goto line 1581
> 2. In line 1581 we have null dereference because printk called with card2-
> >interface.id in third parameter.
>
> 1580 if (!(card2 = icn_initcard(port, id2))) {
> 1581 printk(KERN_INFO
> 1582 "icn: (%s) half ICN-4B, port 0x%x added\n",
> 1583 card2->interface.id, port);
> 1584 return 0;
> 1585 }

After reading icn_addcard() it seems like the code was meant to use
'card' not 'card2' there.

--
Bartlomiej Zolnierkiewicz