2009-07-19 12:52:07

by Dan Carpenter

Subject: [patch] wireless: potential null deref in p54spi.c

We can't use dev_err() becuase "priv" is NULL.

Found by smatch (http://repo.or.cz/w/smatch.git).

regards,
dan carpenter

Signed-off-by: Dan Carpenter <[email protected]>

--- orig/drivers/net/wireless/p54/p54spi.c 2009-07-17 16:04:20.000000000 +0300
+++ new/drivers/net/wireless/p54/p54spi.c 2009-07-17 16:05:28.000000000 +0300
@@ -635,7 +635,7 @@

hw = p54_init_common(sizeof(*priv));
if (!hw) {
- dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+ printk(KERN_ERR "could not alloc ieee80211_hw");
return -ENOMEM;
}

2009-07-22 16:21:19

by Dan Carpenter

Subject: Re: [PATCH v2] p54spi: fix potential null deref in p54spi.c

Great.

Acked-by: Dan Carpenter <[email protected]>

regards,
dan carpenter

On 7/19/09, Christian Lamparter <[email protected]> wrote:
> From: Dan Carpenter <[email protected]>
>
> Fix a potential NULL dereference bug during
> error handling in p54spi_probe.
>
> This bug was discovered by smatch:
> (http://repo.or.cz/w/smatch.git).
>
> Signed-off-by: Dan Carpenter <[email protected]>
> Signed-off-by: Christian Lamparter <[email protected]>
> ---
> On Sunday 19 July 2009 13:53:57 Dan Carpenter wrote:
>
>> We can't use dev_err() becuase "priv" is NULL.
> yep, but that's my fault and not Micheal's.
>
>> Found by smatch (http://repo.or.cz/w/smatch.git).
>> regards,
>> dan carpenter
> what about this alternative?
> it retains the dev_err by simply moving to the spi_device *spi
> which comes from spi-subsystem and is initialized?
>
> Regards,
> Chr
> ---
> diff --git a/drivers/net/wireless/p54/p54spi.c
> b/drivers/net/wireless/p54/p54spi.c
> index d5f181a..eef5329 100644
> --- a/drivers/net/wireless/p54/p54spi.c
> +++ b/drivers/net/wireless/p54/p54spi.c
> @@ -600,7 +600,7 @@ static int __devinit p54spi_probe(struct spi_device
> *spi)
>
> hw = p54_init_common(sizeof(*priv));
> if (!hw) {
> - dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
> + dev_err(&spi->dev, "could not alloc ieee80211_hw");
> return -ENOMEM;
> }
>
>
>
>

2009-07-19 19:26:17

by Christian Lamparter

Subject: [PATCH v2] p54spi: fix potential null deref in p54spi.c

From: Dan Carpenter <[email protected]>

Fix a potential NULL dereference bug during
error handling in p54spi_probe.

This bug was discovered by smatch:
(http://repo.or.cz/w/smatch.git).

Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Christian Lamparter <[email protected]>
---
On Sunday 19 July 2009 13:53:57 Dan Carpenter wrote:

> We can't use dev_err() becuase "priv" is NULL.
yep, but that's my fault and not Micheal's.

> Found by smatch (http://repo.or.cz/w/smatch.git).
> regards,
> dan carpenter
what about this alternative?
it retains the dev_err by simply moving to the spi_device *spi
which comes from spi-subsystem and is initialized?

Regards,
Chr
---
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index d5f181a..eef5329 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -600,7 +600,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)

hw = p54_init_common(sizeof(*priv));
if (!hw) {
- dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+ dev_err(&spi->dev, "could not alloc ieee80211_hw");
return -ENOMEM;
}