Commit 4ecc8c06 authored May 12, 2008 by Julia Lawall Committed by Jeff Garzik May 22, 2008

drivers/net/fs_enet: remove null pointer dereference

The following code appears in the function fs_init_instance in the file drivers/net/fs_enet/fs_enet-main.c.

	if (fep->ops == NULL) {
		printk(KERN_ERR DRV_MODULE_NAME
		       ": %s No matching ops found (%d).\n",
		       ndev->name, fpi->fs_no);
		err = -EINVAL;
		goto err;
	}

This code implies that at the point of err, fep->ops can be NULL, so an
extra test is needed before dereferencing this value.

This problem was found using the following semantic match
(http://www.emn.fr/x-info/coccinelle/

)

// <smpl>
@@
expression E, E1;
identifier f;
statement S1,S2,S3;
@@

* if (E == NULL)
{
  ... when != if (E == NULL) S1 else S2
      when != E = E1
* E->f
  ... when any
  return ...;
}
else S3
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

parent 0b5923cd

drivers/net/fs_enet/fs_enet-main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1093,7 +1093,7 @@ static struct net_device fs_init_instance(struct device dev,
		if (registered)
		unregister_netdev(ndev);

		if (fep != NULL) {
		if (fep && fep->ops) {
		(*fep->ops->free_bd)(ndev);
		(*fep->ops->cleanup_data)(ndev);
		}