2015-10-07 09:33:39

by Vincent Stehlé

Subject: [PATCH] nfc: netlink: avoid NULL pointer dereference on error

The function nfc_genl_llc_sdreq() can dereference the dev pointer while
it is NULL on its error path. Create a new error handling label to avoid
that.

This fixes the following coccinelle error:

./net/nfc/netlink.c:1175:21-24: ERROR: dev is NULL but dereferenced.

Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Thierry Escande <[email protected]>
Cc: Samuel Ortiz <[email protected]>
---
net/nfc/netlink.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 853172c..51c48f0 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1111,7 +1111,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
dev = nfc_get_device(idx);
if (!dev) {
rc = -ENODEV;
- goto exit;
+ goto exit_nodev;
}

device_lock(&dev->dev);
@@ -1176,6 +1176,7 @@ exit:

nfc_put_device(dev);

+exit_nodev:
return rc;
}

--
2.5.1

2015-10-20 04:50:43

by Samuel Ortiz

Subject: Re: [PATCH] nfc: netlink: avoid NULL pointer dereference on error

Hi Vincent,

On Wed, Oct 07, 2015 at 11:33:19AM +0200, Vincent Stehl? wrote:
> The function nfc_genl_llc_sdreq() can dereference the dev pointer while
> it is NULL on its error path. Create a new error handling label to avoid
> that.
>
> This fixes the following coccinelle error:
>
> ./net/nfc/netlink.c:1175:21-24: ERROR: dev is NULL but dereferenced.
>
> Signed-off-by: Vincent Stehl? <[email protected]>
> Cc: Thierry Escande <[email protected]>
> Cc: Samuel Ortiz <[email protected]>
> ---
> net/nfc/netlink.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
> index 853172c..51c48f0 100644
> --- a/net/nfc/netlink.c
> +++ b/net/nfc/netlink.c
> @@ -1111,7 +1111,7 @@ static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
> dev = nfc_get_device(idx);
> if (!dev) {
> rc = -ENODEV;
> - goto exit;
> + goto exit_nodev;
> }
Julia Lawall sent a better fix that I applied:

- if (!dev) {
- rc = -ENODEV;
- goto exit;
- }
+ if (!dev)
+ return -ENODEV;

Cheers,
Samuel.