Re: [2.6 patch] drivers/ieee1394/raw1394.c: fix a NULL pointer dereference

[Dave Jones]

On Mon, Nov 21, 2005 at 12:20:09AM +0100, Adrian Bunk wrote:
 > The coverity checker spotted that this was a NULL pointer dereference in 
 > the "if (copy_from_user(...))" case.
 > 
 > 
 > Signed-off-by: Adrian Bunk <bunk@xxxxxxxxx>
 > 
 > --- linux-2.6.15-rc1-mm2-full/drivers/ieee1394/raw1394.c.old	2005-11-20 22:08:57.000000000 +0100
 > +++ linux-2.6.15-rc1-mm2-full/drivers/ieee1394/raw1394.c	2005-11-20 22:09:34.000000000 +0100
 > @@ -2166,7 +2166,8 @@
 >  			}
 >  		}
 >  	}
 > -	kfree(cache->filled_head);
 > +	if(cache->filled_head)
 > +		kfree(cache->filled_head);
 >  	kfree(cache);
 >  
 >  	if (ret >= 0) {
 > 

How do we get that far with a NULL filled_head ?
If the kmalloc that fills cache->filled_head fails, we bail out early above.

		Dave

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/