Hello, during checking the linux kernel with the static code analysis tool cppcheck, i found a possible null pointer dereference in file linux-2.6.30/drivers/net/wireless/ray_cs.c at line 1511 and 1512. Take a look at the sourcecode: static iw_stats *ray_get_wireless_stats(struct net_device *dev) { ray_dev_t *local = netdev_priv(dev); 1511 struct pcmcia_device *link = local->finder; 1512 struct status __iomem *p = local->sram + STATUS_BASE; 1514 if (local == (ray_dev_t *) NULL) return (iw_stats *) NULL; .... As you can see the pointer local is first used and then it is checked of validity. See the if statement at line 1514. A possible solution might be: static iw_stats *ray_get_wireless_stats(struct net_device *dev) { ray_dev_t *local = netdev_priv(dev); if (local == (ray_dev_t *) NULL) return (iw_stats *) NULL; struct pcmcia_device *link = local->finder; struct status __iomem *p = local->sram + STATUS_BASE; ... Best regards Ettl Martin
Give it some thought, man. How can static inline void *netdev_priv(const struct net_device *dev) { return (char *)dev + ALIGN(sizeof(struct net_device), NETDEV_ALIGN); } ever return NULL?
(I guess I meant to say: don't run static checkers if you're not willing to understand the result)
Created attachment 22510 [details] 0001-ray_cs-avoid-potential-null-dereference-in-ray_get_.patch
Ha! Good point, Johannes...
(In reply to comment #2) > (I guess I meant to say: don't run static checkers if you're not willing to > understand the result) :-)
Created attachment 22511 [details] 0001-ray_cs-remove-bocus-NULL-check-at-head-of-ray_get_w.patch
(In reply to comment #5) > (In reply to comment #2) > > (I guess I meant to say: don't run static checkers if you're not willing to > > understand the result) > > :-) That should read "Sorry, I'm ashamed to not have looked into it properly and to have wasted your time on a driver for hardware that nobody owns any more".
commit 11866efa9b5d6f321a2625b7f6837ba55c4c2e4b Author: John W. Linville <linville@tuxdriver.com> Date: Mon Jul 27 10:56:41 2009 -0400 ray_cs: remove bogus NULL check at head of ray_get_wireless_stats Reported-by: Johannes Berg <johannes@sipsolutions.net> Cc: Martin Ettl <ettl.martin@gmx.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>