netdev - Re: [PATCH] isdn: isdnloop: fix pointer dereference bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190307151742.GC20201@archlinux-ryzen>
Date:   Thu, 7 Mar 2019 08:17:42 -0700
From:   Nathan Chancellor <natechancellor@...il.com>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     Karsten Keil <isdn@...ux-pingi.de>,
        "David S. Miller" <davem@...emloft.net>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] isdn: isdnloop: fix pointer dereference bug

On Thu, Mar 07, 2019 at 10:32:07AM +0100, Arnd Bergmann wrote:
> clang has spotted an ancient code bug and warns about it with:
> 
> drivers/isdn/isdnloop/isdnloop.c:573:12: error: address of array 'card->rcard' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion]
> 
> This is an array of pointers, so we should check if a specific
> pointer exists in the array before using it, not whether the
> array itself exists.
> 
> Signed-off-by: Arnd Bergmann <arnd@...db.de>

Reviewed-by: Nathan Chancellor <natechancellor@...il.com>

> ---
>  drivers/isdn/isdnloop/isdnloop.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
> index f4253d468ae1..755c6bbc9553 100644
> --- a/drivers/isdn/isdnloop/isdnloop.c
> +++ b/drivers/isdn/isdnloop/isdnloop.c
> @@ -570,7 +570,7 @@ isdnloop_atimeout(isdnloop_card *card, int ch)
>  	char buf[60];
>  
>  	spin_lock_irqsave(&card->isdnloop_lock, flags);
> -	if (card->rcard) {
> +	if (card->rcard[ch]) {
>  		isdnloop_fake(card->rcard[ch], "DDIS_I", card->rch[ch] + 1);
>  		card->rcard[ch]->rcard[card->rch[ch]] = NULL;
>  		card->rcard[ch] = NULL;
> -- 
> 2.20.0
>