[PATCH] fec: fix possible NULL dereference in fec_mode_walk()

[PATCH] fec: fix possible NULL dereference in fec_mode_walk()

[ant.v.moryakov]

From: AntonMoryakov <ant.v.moryakov@gmail.com>

Static analyzer (Svace) reported a possible null pointer dereference
in fec_mode_walk(), where the 'name' pointer is passed to print_string()
without checking for NULL.

Although some callers check the return value of get_string(), others
(e.g., walk_bitset()) do not. This patch adds an early NULL check
to avoid dereferencing a null pointer.

This resolves:
DEREF_OF_NULL.EX.COND: json_print.c:142 via fec.c

Found by Svace static analysis tool.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

---
 netlink/fec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/netlink/fec.c b/netlink/fec.c
index 6027dc0..ed100d7 100644
--- a/netlink/fec.c
+++ b/netlink/fec.c
@@ -27,6 +27,8 @@ fec_mode_walk(unsigned int idx, const char *name, bool val, void *data)
 
 	if (!val)
 		return;
+	if (!name)
+		return;
 	if (empty)
 		*empty = false;
 
-- 
2.34.1

Re: [PATCH] fec: fix possible NULL dereference in fec_mode_walk()

[Michal Kubecek]

[-- Attachment #1: Type: text/plain, Size: 1409 bytes --]

Dne Sun, May 18, 2025 at 04:18:18PM GMT, ant.v.moryakov@gmail.com napsal:
> From: AntonMoryakov <ant.v.moryakov@gmail.com>
> 
> Static analyzer (Svace) reported a possible null pointer dereference
> in fec_mode_walk(), where the 'name' pointer is passed to print_string()
> without checking for NULL.
> 
> Although some callers check the return value of get_string(), others
> (e.g., walk_bitset()) do not. This patch adds an early NULL check
> to avoid dereferencing a null pointer.
> 
> This resolves:
> DEREF_OF_NULL.EX.COND: json_print.c:142 via fec.c
> 
> Found by Svace static analysis tool.
> 
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> 
> ---
>  netlink/fec.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/netlink/fec.c b/netlink/fec.c
> index 6027dc0..ed100d7 100644
> --- a/netlink/fec.c
> +++ b/netlink/fec.c
> @@ -27,6 +27,8 @@ fec_mode_walk(unsigned int idx, const char *name, bool val, void *data)
>  
>  	if (!val)
>  		return;
> +	if (!name)
> +		return;
>  	if (empty)
>  		*empty = false;
>  

I'll apply the patch as it makes the code cleaner and safer against
future rewrites but I don't think actual null pointer dereference is
still possible after your patch "json_print: add NULL check before
jsonw_string_field() in print_string()" as it fixes handling both key
and value being null in print_string().

Michal

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH] fec: fix possible NULL dereference in fec_mode_walk()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to ethtool/ethtool.git (master)
by Michal Kubecek <mkubecek@suse.cz>:

On Sun, 18 May 2025 16:18:18 +0300 you wrote:
> From: AntonMoryakov <ant.v.moryakov@gmail.com>
> 
> Static analyzer (Svace) reported a possible null pointer dereference
> in fec_mode_walk(), where the 'name' pointer is passed to print_string()
> without checking for NULL.
> 
> Although some callers check the return value of get_string(), others
> (e.g., walk_bitset()) do not. This patch adds an early NULL check
> to avoid dereferencing a null pointer.
> 
> [...]

Here is the summary with links:
  - fec: fix possible NULL dereference in fec_mode_walk()
    https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/commit/?id=33fffbbdc12d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html