* [patch] ppp: potential NULL dereference in ppp_mp_explode()
@ 2010-09-10 11:58 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2010-09-10 11:58 UTC (permalink / raw)
To: Paul Mackerras
Cc: David S. Miller, Simon Arlott, Ben McKeegan, Stephen Hemminger,
Len Sorensen, linux-ppp, netdev, kernel-janitors
Smatch complains because we check whether "pch->chan" is NULL and then
dereference it unconditionally on the next line. Partly the reason this
bug was introduced is because code was too complicated. I've simplified
it a little.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
Compile tested only. Perhaps it would be better to set pch->speed to
zero? The comments say that zero implies the speed hasn't been set.
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6695a51..736b917 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1314,8 +1314,13 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
hdrlen = (ppp->flags & SC_MP_XSHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
i = 0;
list_for_each_entry(pch, &ppp->channels, clist) {
- navail += pch->avail = (pch->chan != NULL);
- pch->speed = pch->chan->speed;
+ if (pch->chan) {
+ pch->avail = 1;
+ navail++;
+ pch->speed = pch->chan->speed;
+ } else {
+ pch->avail = 0;
+ }
if (pch->avail) {
if (skb_queue_empty(&pch->file.xq) ||
!pch->had_frag) {
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] ppp: potential NULL dereference in ppp_mp_explode()
@ 2010-09-10 11:58 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2010-09-10 11:58 UTC (permalink / raw)
To: Paul Mackerras
Cc: David S. Miller, Simon Arlott, Ben McKeegan, Stephen Hemminger,
Len Sorensen, linux-ppp, netdev, kernel-janitors
Smatch complains because we check whether "pch->chan" is NULL and then
dereference it unconditionally on the next line. Partly the reason this
bug was introduced is because code was too complicated. I've simplified
it a little.
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
Compile tested only. Perhaps it would be better to set pch->speed to
zero? The comments say that zero implies the speed hasn't been set.
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6695a51..736b917 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1314,8 +1314,13 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
hdrlen = (ppp->flags & SC_MP_XSHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
i = 0;
list_for_each_entry(pch, &ppp->channels, clist) {
- navail += pch->avail = (pch->chan != NULL);
- pch->speed = pch->chan->speed;
+ if (pch->chan) {
+ pch->avail = 1;
+ navail++;
+ pch->speed = pch->chan->speed;
+ } else {
+ pch->avail = 0;
+ }
if (pch->avail) {
if (skb_queue_empty(&pch->file.xq) ||
!pch->had_frag) {
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] ppp: potential NULL dereference in ppp_mp_explode()
2010-09-10 11:58 ` Dan Carpenter
@ 2010-09-13 19:45 ` David Miller
-1 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2010-09-13 19:45 UTC (permalink / raw)
To: error27
Cc: paulus, simon, ben, shemminger, lsorense, linux-ppp, netdev,
kernel-janitors
From: Dan Carpenter <error27@gmail.com>
Date: Fri, 10 Sep 2010 13:58:10 +0200
> Smatch complains because we check whether "pch->chan" is NULL and then
> dereference it unconditionally on the next line. Partly the reason this
> bug was introduced is because code was too complicated. I've simplified
> it a little.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> Compile tested only. Perhaps it would be better to set pch->speed to
> zero? The comments say that zero implies the speed hasn't been set.
I think how you've fixed it is OK, actually this whole MP rewrite
could use some more auditing :-)
Applied, thanks Dan.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] ppp: potential NULL dereference in ppp_mp_explode()
@ 2010-09-13 19:45 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2010-09-13 19:45 UTC (permalink / raw)
To: error27
Cc: paulus, simon, ben, shemminger, lsorense, linux-ppp, netdev,
kernel-janitors
From: Dan Carpenter <error27@gmail.com>
Date: Fri, 10 Sep 2010 13:58:10 +0200
> Smatch complains because we check whether "pch->chan" is NULL and then
> dereference it unconditionally on the next line. Partly the reason this
> bug was introduced is because code was too complicated. I've simplified
> it a little.
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---
> Compile tested only. Perhaps it would be better to set pch->speed to
> zero? The comments say that zero implies the speed hasn't been set.
I think how you've fixed it is OK, actually this whole MP rewrite
could use some more auditing :-)
Applied, thanks Dan.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-09-13 19:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-09-10 11:58 [patch] ppp: potential NULL dereference in ppp_mp_explode() Dan Carpenter
2010-09-10 11:58 ` Dan Carpenter
2010-09-13 19:45 ` David Miller
2010-09-13 19:45 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.