* [Patch] NULL pointer dereference in drivers/message/i2o/i2o_config.c
@ 2006-05-30 21:17 Eric Sesterhenn
0 siblings, 0 replies; only message in thread
From: Eric Sesterhenn @ 2006-05-30 21:17 UTC (permalink / raw)
To: LKML; +Cc: markus.lidel
hi,
i am not sure if there is some black magic which prevents this
from happening, it is spotted by coverity id #265
499 for (p = open_files; p; p = p->next)
500 if (p->q_id == (ulong) fp->private_data)
501 break;
502
503 if (!p->q_len)
504 return -ENOENT
if we cant find a p with a p->q_id which matches fp->private data,
we dereference it.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
--- linux-2.6.17-rc4-git2/drivers/message/i2o/i2o_config.c.orig 2006-05-30 23:12:13.000000000 +0200
+++ linux-2.6.17-rc4-git2/drivers/message/i2o/i2o_config.c 2006-05-30 23:13:30.000000000 +0200
@@ -500,7 +500,7 @@ static int i2o_cfg_evt_get(unsigned long
if (p->q_id == (ulong) fp->private_data)
break;
- if (!p->q_len)
+ if (!p || !p->q_len)
return -ENOENT;
memcpy(&kget.info, &p->event_q[p->q_out], sizeof(struct i2o_evt_info));
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2006-05-30 21:17 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-05-30 21:17 [Patch] NULL pointer dereference in drivers/message/i2o/i2o_config.c Eric Sesterhenn
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).