[patch] hamradio: avoid null deref

[patch] hamradio: avoid null deref

[Dan Carpenter]

If dev == NULL we shouldn't dereference it.

Signed-off-by: Dan Carpenter <error27@gmail.com>

--- orig/drivers/net/hamradio/bpqether.c	2009-12-22 23:58:56.000000000 +0200
+++ devel/drivers/net/hamradio/bpqether.c	2009-12-22 23:59:46.000000000 +0200
@@ -283,7 +283,6 @@ static netdev_tx_t bpq_xmit(struct sk_bu
 	bpq = netdev_priv(dev);
 
 	if ((dev = bpq_get_ether_dev(dev)) == NULL) {
-		dev->stats.tx_dropped++;
 		kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}

Re: [patch] hamradio: avoid null deref

[Jarek Poplawski]

Dan Carpenter wrote, On 12/23/2009 02:25 PM:

> If dev == NULL we shouldn't dereference it.
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> 
> --- orig/drivers/net/hamradio/bpqether.c	2009-12-22 23:58:56.000000000 +0200
> +++ devel/drivers/net/hamradio/bpqether.c	2009-12-22 23:59:46.000000000 +0200
> @@ -283,7 +283,6 @@ static netdev_tx_t bpq_xmit(struct sk_bu
>  	bpq = netdev_priv(dev);
>  
>  	if ((dev = bpq_get_ether_dev(dev)) == NULL) {
> -		dev->stats.tx_dropped++;

Why not use a separate variable for another dev? This stat
should be helpful for debugging.

Jarek P.

>  		kfree_skb(skb);
>  		return NETDEV_TX_OK;
>  	}

Re: [patch] hamradio: avoid null deref

[David Miller]

From: Jarek Poplawski <jarkao2@gmail.com>
Date: Wed, 23 Dec 2009 18:47:46 +0100

> Dan Carpenter wrote, On 12/23/2009 02:25 PM:
> 
>> If dev == NULL we shouldn't dereference it.
>> 
>> Signed-off-by: Dan Carpenter <error27@gmail.com>
>> 
>> --- orig/drivers/net/hamradio/bpqether.c	2009-12-22 23:58:56.000000000 +0200
>> +++ devel/drivers/net/hamradio/bpqether.c	2009-12-22 23:59:46.000000000 +0200
>> @@ -283,7 +283,6 @@ static netdev_tx_t bpq_xmit(struct sk_bu
>>  	bpq = netdev_priv(dev);
>>  
>>  	if ((dev = bpq_get_ether_dev(dev)) == NULL) {
>> -		dev->stats.tx_dropped++;
> 
> Why not use a separate variable for another dev? This stat
> should be helpful for debugging.

And that is definitely the intent of the code here, to
bump the statistic in the original device object.

[patch] hamradio: avoid null deref v2

[Dan Carpenter]

Bump the stats on the original dev not on the newly assigned NULL version of
dev.

Signed-off-by: Dan Carpenter <error27@gmail.com>

--- orig/drivers/net/hamradio/bpqether.c	2009-12-22 23:58:56.000000000 +0200
+++ devel/drivers/net/hamradio/bpqether.c	2009-12-25 19:49:05.000000000 +0200
@@ -282,11 +282,12 @@ static netdev_tx_t bpq_xmit(struct sk_bu
 
 	bpq = netdev_priv(dev);
 
-	if ((dev = bpq_get_ether_dev(dev)) == NULL) {
+	if (!bpq->ethdev) {
 		dev->stats.tx_dropped++;
 		kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}
+	dev = bpq_get_ether_dev(dev);
 
 	skb->protocol = ax25_type_trans(skb, dev);
 	skb_reset_network_header(skb);

Re: [patch] hamradio: avoid null deref v2

[David Miller]

From: Dan Carpenter <error27@gmail.com>
Date: Sat, 26 Dec 2009 14:38:12 +0200

> Bump the stats on the original dev not on the newly assigned NULL version of
> dev.
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>

This doesn't look real nice.

The bpq_get_ether_dev() abstraction exists so that the details of
bpq->this and bpq->that are hidden behind it.

Exposing those details inline just to fix this bug makes the
abstraction significantly less useful, and the code more ugly.

Please just create an "orig_dev" pointer to save the original device
in, and use it to fix this problem properly.

That way you only fetch the bpq ether device pointer via the
abstraction interface.

And BTW, this is how other reviewers told you to implement this
fix. :-)

Thanks.

[patch] hamradio: avoid null deref v3

[Dan Carpenter]

This should address the problems in version 1 (lazy) and version 2 (ugly).

Bump the stats on orig_dev not on the newly assigned NULL dev variable.

Signed-off-by: Dan Carpenter <error27@gmail.com>

--- orig/drivers/net/hamradio/bpqether.c	2009-12-22 23:58:56.000000000 +0200
+++ devel/drivers/net/hamradio/bpqether.c	2009-12-28 00:12:48.000000000 +0200
@@ -248,6 +248,7 @@ static netdev_tx_t bpq_xmit(struct sk_bu
 {
 	unsigned char *ptr;
 	struct bpqdev *bpq;
+	struct net_device *orig_dev;
 	int size;
 
 	/*
@@ -282,8 +283,9 @@ static netdev_tx_t bpq_xmit(struct sk_bu
 
 	bpq = netdev_priv(dev);
 
+	orig_dev = dev;
 	if ((dev = bpq_get_ether_dev(dev)) == NULL) {
-		dev->stats.tx_dropped++;
+		orig_dev->stats.tx_dropped++;
 		kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}

Re: [patch] hamradio: avoid null deref v3

[David Miller]

From: Dan Carpenter <error27@gmail.com>
Date: Mon, 28 Dec 2009 18:54:55 +0200

> This should address the problems in version 1 (lazy) and version 2 (ugly).
> 
> Bump the stats on orig_dev not on the newly assigned NULL dev variable.
> 
> Signed-off-by: Dan Carpenter <error27@gmail.com>

Applied.