Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752372AbWCPLI0 (ORCPT ); Thu, 16 Mar 2006 06:08:26 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752377AbWCPLI0 (ORCPT ); Thu, 16 Mar 2006 06:08:26 -0500 Received: from cantor.suse.de ([195.135.220.2]:14783 "EHLO mx1.suse.de") by vger.kernel.org with ESMTP id S1752372AbWCPLIZ (ORCPT ); Thu, 16 Mar 2006 06:08:25 -0500 Date: Thu, 16 Mar 2006 12:08:24 +0100 Message-ID: From: Takashi Iwai To: Eugene Teo Cc: linux-kernel@vger.kernel.org Subject: Re: Fix ali5451 dereferenced before NULL check In-Reply-To: <20060316013602.GA20455@eugeneteo.net> References: <20060316013602.GA20455@eugeneteo.net> User-Agent: Wanderlust/2.12.0 (Your Wildest Dreams) SEMI/1.14.6 (Maruoka) FLIM/1.14.7 (=?ISO-8859-4?Q?Sanj=F2?=) APEL/10.6 MULE XEmacs/21.5 (beta24) (dandelion) (i386-suse-linux) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1673 Lines: 54 At Thu, 16 Mar 2006 09:36:02 +0800, Eugene Teo wrote: > > pvoice is missing a NULL check. channel needs a bound check too. Both checks are not necessary. There is a single caller to this function, and the channel argument is a loop value of for (channel = 0; channel < ALI_CHANNELS; channel++) snd_ali_update_ptr(codec, channel); pvoice is the address pointing a part of a structure, so it cannot be NULL anyway. If a check were needed, it should be if (codec != NULL). Takashi > > Coverity bug #862 > > Signed-off-by: Eugene Teo > > --- linux-2.6/sound/pci/ali5451/ali5451.c~ 2006-03-15 10:05:45.000000000 +0800 > +++ linux-2.6/sound/pci/ali5451/ali5451.c 2006-03-16 09:27:53.000000000 +0800 > @@ -990,7 +990,13 @@ > if (!(old & mask)) > return; > > + if (channel < 0 || channel >= ALI_CHANNELS) > + return; > + > pvoice = &codec->synth.voices[channel]; > + if (pvoice == NULL) > + return; > + > runtime = pvoice->substream->runtime; > > udelay(100); > > -- > 1024D/A6D12F80 print D51D 2633 8DAC 04DB 7265 9BB8 5883 6DAA A6D1 2F80 > main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); } > > - > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ > - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/