linux-kernel - Re: [2.6 patch] drivers/net/wireless/libertas/fw.c: fix use-before-check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070518174721.GB3492@tuxdriver.com>
Date:	Fri, 18 May 2007 13:47:21 -0400
From:	"John W. Linville" <linville@...driver.com>
To:	Eugene Teo <eteo@...hat.com>
Cc:	linux-kernel@...r.kernel.org, jeff@...zik.org,
	linux-wireless@...r.kernel.org
Subject: Re: [2.6 patch] drivers/net/wireless/libertas/fw.c: fix use-before-check

This should be sent to linux-wireless (and CC'ed to me) as well...

On Sat, May 19, 2007 at 01:06:49AM +0800, Eugene Teo wrote:
> NULL checks should be performed before the dereference.
> 
> Spotted by the Coverity checker.
> 
> Signed-off-by: Eugene Teo <eteo@...hat.com>
> 
> diff --git a/drivers/net/wireless/libertas/fw.c b/drivers/net/wireless/libertas/fw.c
> index 441123c..5c63c9b 100644
> --- a/drivers/net/wireless/libertas/fw.c
> +++ b/drivers/net/wireless/libertas/fw.c
> @@ -333,18 +333,22 @@ static void command_timer_fn(unsigned long data)
>         unsigned long flags;
> 
>         ptempnode = adapter->cur_cmd;
> +       if (ptempnode == NULL) {
> +               lbs_pr_debug(1, "PTempnode Empty\n");
> +               return;
> +       }
> +
>         cmd = (struct cmd_ds_command *)ptempnode->bufvirtualaddr;
> +       if (!cmd) {
> +               lbs_pr_debug(1, "cmd is NULL\n");
> +               return;
> +       }
> 
>         lbs_pr_info("command_timer_fn fired (%x)\n", cmd->command);
> 
>         if (!adapter->fw_ready)
>                 return;
> 
> -       if (ptempnode == NULL) {
> -               lbs_pr_debug(1, "PTempnode Empty\n");
> -               return;
> -       }
> -
>         spin_lock_irqsave(&adapter->driver_lock, flags);
>         adapter->cur_cmd = NULL;
>         spin_unlock_irqrestore(&adapter->driver_lock, flags);
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

-- 
John W. Linville
linville@...driver.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/