Search Linux Wireless

Re: [PATCH] mwifiex: fix possible NULL dereference

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Andy Shevchenko <andy.shevchenko@xxxxxxxxx> wrote:

On Mon, Apr 11, 2016 at 6:27 PM, Sudip Mukherjee
<sudipm.mukherjee@xxxxxxxxx> wrote:
From: Sudip Mukherjee <sudip.mukherjee@xxxxxxxxxxxxxxx>

We have a check for card just after dereferencing it. So if it is NULL
we have already dereferenced it before its check. Lets dereference it
after checking card for NULL.

IIUC the code does nothing with dereference.

I would have told NAK if I would have been maintainer.

Signed-off-by: Sudip Mukherjee <sudip.mukherjee@xxxxxxxxxxxxxxx>
---
 drivers/net/wireless/marvell/mwifiex/pcie.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index edf8b07..84562d0 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -2884,10 +2884,11 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
        struct pcie_service_card *card = adapter->card;

Let's say it's 0.

       const struct mwifiex_pcie_card_reg *reg;
-       struct pci_dev *pdev = card->dev;

This would be equal to offset of dev member in pcie_service_card struct.

Nothing wrong here.

Actually, that is not true. The dereference of card tells the compiler that card can't be NULL, so it is free to eliminate the check below. Unbelievably, this can even happen for a reference such as &ptr->thing where the pointer isn't even actually dereferenced at all!

+       struct pci_dev *pdev;
        int i;

        if (card) {
+               pdev = card->dev;
                if (card->msix_enable) {
                        for (i = 0; i < MWIFIEX_NUM_MSIX_VECTORS; i++)
                                synchronize_irq(card->msix_entries[i].vector);
--
1.9.1



--
With Best Regards,
Andy Shevchenko


--
Mark Rustad, Networking Division, Intel Corporation

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Wireless Personal Area Network]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Hiking]     [MIPS Linux]     [ARM Linux]     [Linux RAID]

  Powered by Linux