Re: Null pointer dereference in ngene-core.c

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Sep 19, 2016 at 8:51 PM, Alexandre-Xavier Labonté-Lamoureux
<axdoomer@xxxxxxxxx> wrote:
> Hi people,
>
> In the file "/linux/drivers/media/pci/ngene/ngene-core.c", there is a
> null pointer dereference at line 1480.
>
> Code in the function "static int init_channel(struct ngene_channel *chan)"
> ======================================
> if (io & NGENE_IO_TSIN) {
>     chan->fe = NULL;                      // Set to NULL
>     if (ni->demod_attach[nr]) {         // First condition
>        ret = ni->demod_attach[nr](chan);
>             if (ret < 0)                           // Another condition
>                 goto err;                         // Goto that avoids
> the problem
>     }
>     if (chan->fe && ni->tuner_attach[nr]) {     // Condition that
> tests the null pointer
>         ret = ni->tuner_attach[nr](chan);
>         if (ret < 0)
>             goto err;
>     }
> }
> =====================================
>
> "chan->fe" is set to NULL, then it tests for something (I have no idea
> what it's doing, I know nothing about this driver), if the results of
> the first two if conditions fail to reach the goto, then it will test
> the condition with the null pointer, which will cause a crash. I don't
> know if the kernel can recover from null pointers, I think not.

This looks fine to me.  It's a simple test to see if chan->fe got set
to null (presumably in the above block of code).  A null pointer
dereference would be if the first block set *chan* to NULL (as opposed
to chan->fe) and then the if() statement then attempted to inspect
chan->fe.

LGTM.

Devin

-- 
Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html




[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux