Re: [B.A.T.M.A.N.] FWD: batman: potential null dereference

[Sven Eckelmann <sven.eckelmann@gmx.de>]

[-- Attachment #1: Type: Text/Plain, Size: 1429 bytes --]

Andrew Lunn wrote:
> Does somebody have time to look at this?
> ----- Forwarded message from Dan Carpenter <error27@gmail.com> -----
[...]
> drivers/staging/batman-adv/routing.c
>     88          } else if ((orig_node->router == NULL) && (neigh_node !=
>  NULL)) { ^^^^^^^^^^^^^^^^^^^^^^^^^
>     89
>     90                  bat_dbg(DBG_ROUTES,
>     91                          "Adding route towards: %pM (via %pM)\n",
>     92                          orig_node->orig, neigh_node->addr);
>     93                  hna_global_add_orig(orig_node, hna_buff,
>  hna_buff_len); 94
>     95                  /* route changed */
>     96          } else {
>     97                  bat_dbg(DBG_ROUTES, "Changing route towards: %pM
>  (now via %pM - was via %pM)\n", orig_node->orig, neigh_node->addr,
>  orig_node->router->addr);
>                                    ^^^^^^^^^^^^^^^^^^^^^^^
>     98          }
> 
> This could fail if debugging is enabled and neigh_node is null.

It looks a little bit like checked with clang's static analyzer. This analyzer 
has problems to track constraints at all. This means that it doesn't catch the 
update_routes constraint "orig_node->router != neigh_node".

But I am also not good at tracking that kind of constraints and reported this 
or a similar "bug" in batmand a while ago.

So it is not a real bug, but maybe not easy to read.

Best regards,
	Sven

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]