[PATCH] fddi/skfp: fix null pointer dereference in smt.c

[PATCH] fddi/skfp: fix null pointer dereference in smt.c

[Siddarth G]

In smt_string_swap(), when a closing bracket ']' is encountered
before any opening bracket '[' open_paren would be NULL,
and assigning it to format would lead to a null pointer being
dereferenced in the format++ statement.

Add a check to verify open_paren is non-NULL before assigning
it to format

Fixes: CID 100271 (Coverity Scan)

Signed-off-by: Siddarth G <siddarthsgml@gmail.com>
---
 drivers/net/fddi/skfp/smt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/fddi/skfp/smt.c b/drivers/net/fddi/skfp/smt.c
index dd15af4e98c2..174f279b89ac 100644
--- a/drivers/net/fddi/skfp/smt.c
+++ b/drivers/net/fddi/skfp/smt.c
@@ -1857,7 +1857,8 @@ static void smt_string_swap(char *data, const char *format, int len)
 			open_paren = format ;
 			break ;
 		case ']' :
-			format = open_paren ;
+			if (open_paren)
+				format = open_paren ;
 			break ;
 		case '1' :
 		case '2' :
-- 
2.43.0

Re: [PATCH] fddi/skfp: fix null pointer dereference in smt.c

[Simon Horman]

On Mon, May 05, 2025 at 02:40:25PM +0530, Siddarth G wrote:
> In smt_string_swap(), when a closing bracket ']' is encountered
> before any opening bracket '[' open_paren would be NULL,
> and assigning it to format would lead to a null pointer being
> dereferenced in the format++ statement.
> 
> Add a check to verify open_paren is non-NULL before assigning
> it to format
> 
> Fixes: CID 100271 (Coverity Scan)

* If there is a public link for the issue, then I think
  it would be appropriate to include it in a "closes: "
  tag.

  Else, I think it would be best to simply state something like
  "This issue was reported by Coverity Scan."

* The Fixes: tag should (only) refer to the commit that
  introduced the bug. In this case it looks like the bug goes
  all the way back to the beginning of git history.
  If so the tag should cite the very first commit.

  Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

* Please don't leave a space between the Fixes tag and Signed-off-by tag.
  (Or between any other tags.)

* Assuming this is a but, please target it at the net tree like this:

  Subject: [PATCH net v2] ...

  Patches for net should have a Fixes tag.

  Otherwise the patch should be targeted at the net-next tree.
  And there should not be a Fixes tag.

* If you post a v2, please observe the 24 hour rule

  https://docs.kernel.org/process/maintainer-netdev.html

> 
> Signed-off-by: Siddarth G <siddarthsgml@gmail.com>

Please consider expanding G out to the name it is short for
(assuming that is the case) both in the Signed-off-by line and From address.

Thanks.

> ---
>  drivers/net/fddi/skfp/smt.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/fddi/skfp/smt.c b/drivers/net/fddi/skfp/smt.c
> index dd15af4e98c2..174f279b89ac 100644
> --- a/drivers/net/fddi/skfp/smt.c
> +++ b/drivers/net/fddi/skfp/smt.c
> @@ -1857,7 +1857,8 @@ static void smt_string_swap(char *data, const char *format, int len)
>  			open_paren = format ;
>  			break ;
>  		case ']' :
> -			format = open_paren ;
> +			if (open_paren)
> +				format = open_paren ;
>  			break ;
>  		case '1' :
>  		case '2' :
> -- 
> 2.43.0

-- 
pw-bot: changes-requested