[patch] wireless: potential null deref in p54spi.c

[patch] wireless: potential null deref in p54spi.c

[Dan Carpenter]

We can't use dev_err() becuase "priv" is NULL.

Found by smatch (http://repo.or.cz/w/smatch.git).

regards,
dan carpenter

Signed-off-by: Dan Carpenter <error27@gmail.com>

--- orig/drivers/net/wireless/p54/p54spi.c	2009-07-17 16:04:20.000000000 +0300
+++ new/drivers/net/wireless/p54/p54spi.c	2009-07-17 16:05:28.000000000 +0300
@@ -635,7 +635,7 @@
 
 	hw = p54_init_common(sizeof(*priv));
 	if (!hw) {
-		dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+		printk(KERN_ERR "could not alloc ieee80211_hw");
 		return -ENOMEM;
 	}
 

[PATCH v2] p54spi: fix potential null deref in p54spi.c

[Christian Lamparter]

From: Dan Carpenter <error27@gmail.com>

Fix a potential NULL dereference bug during 
error handling in p54spi_probe.

This bug was discovered by smatch:
(http://repo.or.cz/w/smatch.git).

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@web.de>
---
On Sunday 19 July 2009 13:53:57 Dan Carpenter wrote:

> We can't use dev_err() becuase "priv" is NULL.
yep, but that's my fault and not Micheal's.

> Found by smatch (http://repo.or.cz/w/smatch.git).
> regards,
> dan carpenter
what about this alternative?
it retains the dev_err by simply moving to the spi_device *spi
which comes from spi-subsystem and is initialized?

Regards,
	Chr
---
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index d5f181a..eef5329 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -600,7 +600,7 @@ static int __devinit p54spi_probe(struct spi_device *spi)
 
 	hw = p54_init_common(sizeof(*priv));
 	if (!hw) {
-		dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
+		dev_err(&spi->dev, "could not alloc ieee80211_hw");
 		return -ENOMEM;
 	}
 

Re: [PATCH v2] p54spi: fix potential null deref in p54spi.c

[Dan Carpenter]

Great.

Acked-by: Dan Carpenter <error27@gmail.com>

regards,
dan carpenter

On 7/19/09, Christian Lamparter <chunkeey@web.de> wrote:
> From: Dan Carpenter <error27@gmail.com>
>
> Fix a potential NULL dereference bug during
> error handling in p54spi_probe.
>
> This bug was discovered by smatch:
> (http://repo.or.cz/w/smatch.git).
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Christian Lamparter <chunkeey@web.de>
> ---
> On Sunday 19 July 2009 13:53:57 Dan Carpenter wrote:
>
>> We can't use dev_err() becuase "priv" is NULL.
> yep, but that's my fault and not Micheal's.
>
>> Found by smatch (http://repo.or.cz/w/smatch.git).
>> regards,
>> dan carpenter
> what about this alternative?
> it retains the dev_err by simply moving to the spi_device *spi
> which comes from spi-subsystem and is initialized?
>
> Regards,
> 	Chr
> ---
> diff --git a/drivers/net/wireless/p54/p54spi.c
> b/drivers/net/wireless/p54/p54spi.c
> index d5f181a..eef5329 100644
> --- a/drivers/net/wireless/p54/p54spi.c
> +++ b/drivers/net/wireless/p54/p54spi.c
> @@ -600,7 +600,7 @@ static int __devinit p54spi_probe(struct spi_device
> *spi)
>
>  	hw = p54_init_common(sizeof(*priv));
>  	if (!hw) {
> -		dev_err(&priv->spi->dev, "could not alloc ieee80211_hw");
> +		dev_err(&spi->dev, "could not alloc ieee80211_hw");
>  		return -ENOMEM;
>  	}
>
>
>
>