[PATCH] staging: unisys: virtpci: virtpci: Fix for possible null pointer dereference

[PATCH] staging: unisys: virtpci: virtpci: Fix for possible null pointer dereference

[Rickard Strandqvist]

Fix a possible null pointer dereference, there is
otherwise a risk of a possible null pointer dereference.

This was found using a static code analysis program called cppcheck

Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
---
 drivers/staging/unisys/virtpci/virtpci.c |   20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/staging/unisys/virtpci/virtpci.c b/drivers/staging/unisys/virtpci/virtpci.c
index 39b828d..eea3c64 100644
--- a/drivers/staging/unisys/virtpci/virtpci.c
+++ b/drivers/staging/unisys/virtpci/virtpci.c
@@ -1340,16 +1340,16 @@ static ssize_t virtpci_driver_attr_show(struct kobject *kobj,
 	struct driver_private *dprivate = to_driver(kobj);
 	struct device_driver *driver;
 
-	if (dprivate != NULL)
+	if (dprivate != NULL) {
 		driver = dprivate->driver;
-	else
-		driver = NULL;
 
-	DBGINF("In virtpci_driver_attr_show driver->name:%s\n", driver->name);
-	if (driver) {
+		DBGINF("In virtpci_driver_attr_show driver->name:%s\n", driver->name);
+
 		if (dattr->show)
 			ret = dattr->show(driver, buf);
 	}
+	else
+		DBGINF("In virtpci_driver_attr_show driver:NULL\n");
 	return ret;
 }
 
@@ -1363,17 +1363,17 @@ static ssize_t virtpci_driver_attr_store(struct kobject *kobj,
 	struct driver_private *dprivate = to_driver(kobj);
 	struct device_driver *driver;
 
-	if (dprivate != NULL)
+	if (dprivate != NULL) {
 		driver = dprivate->driver;
-	else
-		driver = NULL;
 
-	DBGINF("In virtpci_driver_attr_store driver->name:%s\n", driver->name);
+		DBGINF("In virtpci_driver_attr_store driver->name:%s\n", driver->name);
 
-	if (driver) {
 		if (dattr->store)
 			ret = dattr->store(driver, buf, count);
 	}
+	else
+		DBGINF("In virtpci_driver_attr_store driver:NULL\n");
+
 	return ret;
 }
 
-- 
1.7.10.4

Re: [PATCH] staging: unisys: virtpci: virtpci: Fix for possible null pointer dereference

[Dan Carpenter]

Run your patches through checkpatch.pl.

On Thu, Jan 29, 2015 at 07:50:26PM +0100, Rickard Strandqvist wrote:
> -	if (dprivate != NULL)
> +	if (dprivate != NULL) {

This is a double negative.  Just say "if (dprivate) {".  Actually just
reverse the test and remove the bogus printk.  Say:

	if (!dprivate)
		return 0;

But *actually* just remove the test entirely because it can never be
NULL.  Same for virtpci_driver_attr_store().

Btw, if you have the smatch cross function database set up then you can
figure out this sort of thing by using:

$ smdb.py virtpci_driver_attr_store

It says that:

     fs/sysfs/file.c |       sysfs_kf_write | (struct sysfs_ops)->store |  PARAM_VALUE |  0 | $ | 4096-2117777777777777777

So this is called from sysfs_kf_write() and parameter zero is a valid
pointer.

regards,
dan carpenter

Re: [PATCH] staging: unisys: virtpci: virtpci: Fix for possible null pointer dereference

[Peter Hurley]

On 01/30/2015 07:39 AM, Dan Carpenter wrote:
> Btw, if you have the smatch cross function database set up then you can
> figure out this sort of thing by using:
> 
> $ smdb.py virtpci_driver_attr_store
> 
> It says that:
> 
>      fs/sysfs/file.c |       sysfs_kf_write | (struct sysfs_ops)->store |  PARAM_VALUE |  0 | $ | 4096-2117777777777777777
> 
> So this is called from sysfs_kf_write() and parameter zero is a valid
> pointer.

Hi Dan,

This would be a good topic for an LWN.net article.

Regards,
Peter Hurley

Re: [PATCH] staging: unisys: virtpci: virtpci: Fix for possible null pointer dereference

[Rickard Strandqvist]

2015-01-30 13:59 GMT+01:00 Peter Hurley <peter@hurleysoftware.com>:
> On 01/30/2015 07:39 AM, Dan Carpenter wrote:
>> Btw, if you have the smatch cross function database set up then you can
>> figure out this sort of thing by using:
>>
>> $ smdb.py virtpci_driver_attr_store
>>
>> It says that:
>>
>>      fs/sysfs/file.c |       sysfs_kf_write | (struct sysfs_ops)->store |  PARAM_VALUE |  0 | $ | 4096-2117777777777777777
>>
>> So this is called from sysfs_kf_write() and parameter zero is a valid
>> pointer.
>
> Hi Dan,
>
> This would be a good topic for an LWN.net article.
>
> Regards,
> Peter Hurley
>

Hi

Okay, I'll do that this weekend.

But I see with you more about Smatch by the way.

Kind regards
Rickard Strandqvist