KERNEL_VERSION: 2.6.32
SUBJECT: null dereference after check
DESCRIBE:
In driver ./drivers/isdn/icn/icn.c in function icn_addcard:
1. If in line 1580 card2 = NULL then we goto line 1581
2. In line 1581 we have null dereference because printk called with card2-
>interface.id in third parameter.
1580 if (!(card2 = icn_initcard(port, id2))) {
1581 printk(KERN_INFO
1582 "icn: (%s) half ICN-4B, port 0x%x added\n",
1583 card2->interface.id, port);
1584 return 0;
1585 }
Found by Linux Device Drivers Verification Project (Svace Detector)
On Tuesday 15 December 2009 06:55:06 pm Alexander Strakh wrote:
> KERNEL_VERSION: 2.6.32
> SUBJECT: null dereference after check
> DESCRIBE:
> In driver ./drivers/isdn/icn/icn.c in function icn_addcard:
>
> 1. If in line 1580 card2 = NULL then we goto line 1581
> 2. In line 1581 we have null dereference because printk called with card2-
> >interface.id in third parameter.
>
> 1580 if (!(card2 = icn_initcard(port, id2))) {
> 1581 printk(KERN_INFO
> 1582 "icn: (%s) half ICN-4B, port 0x%x added\n",
> 1583 card2->interface.id, port);
> 1584 return 0;
> 1585 }
After reading icn_addcard() it seems like the code was meant to use
'card' not 'card2' there.
--
Bartlomiej Zolnierkiewicz