[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20061112065008.GF25057@stusta.de>
Date: Sun, 12 Nov 2006 07:50:08 +0100
From: Adrian Bunk <bunk@...sta.de>
To: David Brownell <david-b@...bell.net>
Cc: linux-usb-devel@...ts.sourceforge.net, greg@...ah.com,
linux-kernel@...r.kernel.org
Subject: Re: [linux-usb-devel] drivers/usb/gadget/ether.c: NULL dereference
On Sat, Nov 11, 2006 at 10:35:48PM -0800, David Brownell wrote:
> On Saturday 11 November 2006 8:06 am, Adrian Bunk wrote:
> > The Coverity checker spotted the following NULL dereference of "skb" in
> > drivers/usb/gadget/ether.c:
>
> I don't see such a dereference. As usual, free(NULL) is legit.
>...
void dev_kfree_skb_any(struct sk_buff *skb)
{
if (in_irq() || irqs_disabled())
dev_kfree_skb_irq(skb);
else
dev_kfree_skb(skb);
}
And the first thing dev_kfree_skb_irq() does is to dereference skb...
> > <-- snip -->
> >
> > ...
> > static int
> > rx_submit (struct eth_dev *dev, struct usb_request *req, gfp_t gfp_flags)
> > {
> > struct sk_buff *skb;
> > int retval = -ENOMEM;
> > ...
> > if ((skb = alloc_skb (size + NET_IP_ALIGN, gfp_flags)) == 0) {
> > DEBUG (dev, "no rx skb\n");
> > goto enomem;
> > }
> > ...
> > enomem:
> > defer_kevent (dev, WORK_RX_MEMORY);
> > if (retval) {
> > DEBUG (dev, "rx submit --> %d\n", retval);
> > dev_kfree_skb_any (skb);
> > ...
> >
> > <-- snip -->
> >
> > cu
> > Adrian
> >
cu
Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
"Only a promise," Lao Er said.
Pearl S. Buck - Dragon Seed
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists