[2.6 patch] drivers/scsi/dpt_i2o.c: fix a NULL pointer dereference

[2.6 patch] drivers/scsi/dpt_i2o.c: fix a NULL pointer dereference

[Adrian Bunk]

The Coverity checker spotted this obvious NULL pointer dereference.


Signed-off-by: Adrian Bunk <bunk@stusta.de>

---

 drivers/scsi/dpt_i2o.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- linux-2.6.15-rc1-mm2-full/drivers/scsi/dpt_i2o.c.old	2005-11-20 22:13:37.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/drivers/scsi/dpt_i2o.c	2005-11-20 22:16:57.000000000 +0100
@@ -816,7 +816,7 @@
 static void adpt_i2o_sys_shutdown(void)
 {
 	adpt_hba *pHba, *pNext;
-	struct adpt_i2o_post_wait_data *p1, *p2;
+	struct adpt_i2o_post_wait_data *p1, *old;
 
 	 printk(KERN_INFO"Shutting down Adaptec I2O controllers.\n");
 	 printk(KERN_INFO"   This could take a few minutes if there are many devices attached\n");
@@ -830,13 +830,14 @@
 	}
 
 	/* Remove any timedout entries from the wait queue.  */
-	p2 = NULL;
 //	spin_lock_irqsave(&adpt_post_wait_lock, flags);
 	/* Nothing should be outstanding at this point so just
 	 * free them 
 	 */
-	for(p1 = adpt_post_wait_queue; p1; p2 = p1, p1 = p2->next) {
-		kfree(p1);
+	for(p1 = adpt_post_wait_queue; p1;) {
+		old = p1;
+		p1 = p1->next;
+		kfree(old);
 	}
 //	spin_unlock_irqrestore(&adpt_post_wait_lock, flags);
 	adpt_post_wait_queue = NULL;

[2.6 patch] drivers/message/i2o/pci.c: fix a NULL pointer dereference

[Adrian Bunk]

The Coverity checker spotted this obvious NULL pointer dereference.


Signed-off-by: Adrian Bunk <bunk@stusta.de>

--- linux-2.6.15-rc1-mm2-full/drivers/message/i2o/pci.c.old	2005-11-20 21:50:45.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/drivers/message/i2o/pci.c	2005-11-20 21:51:08.000000000 +0100
@@ -421,8 +421,8 @@
 	i2o_pci_free(c);
 
       free_controller:
-	i2o_iop_free(c);
 	put_device(c->device.parent);
+	i2o_iop_free(c);
 
       disable:
 	pci_disable_device(pdev);

[2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Adrian Bunk]

The Coverity checker spotted this obvious NULL pointer dereference 
caused by a wrong order of the cleanups.


Signed-off-by: Adrian Bunk <bunk@stusta.de>

--- linux-2.6.15-rc1-mm2-full/drivers/infiniband/core/mad.c.old	2005-11-20 22:04:36.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/drivers/infiniband/core/mad.c	2005-11-20 22:05:17.000000000 +0100
@@ -355,9 +355,9 @@
 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 	kfree(reg_req);
 error3:
-	kfree(mad_agent_priv);
-error2:
 	ib_dereg_mr(mad_agent_priv->agent.mr);
+error2:
+	kfree(mad_agent_priv);
 error1:
 	return ret;
 }

Re: [stable] [2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Greg KH]

Please send these again to the stable@ address when they have been
accepted into upstream.

thanks,

greg k-h

[2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Adrian Bunk]

The Coverity checker spotted this obvious NULL pointer dereference 
caused by a wrong order of the cleanups.


Signed-off-by: Adrian Bunk <bunk@stusta.de>

---

This patch was already sent on:
- 21 Nov 2005

--- linux-2.6.15-rc1-mm2-full/drivers/infiniband/core/mad.c.old	2005-11-20 22:04:36.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/drivers/infiniband/core/mad.c	2005-11-20 22:05:17.000000000 +0100
@@ -355,9 +355,9 @@
 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 	kfree(reg_req);
 error3:
-	kfree(mad_agent_priv);
-error2:
 	ib_dereg_mr(mad_agent_priv->agent.mr);
+error2:
+	kfree(mad_agent_priv);
 error1:
 	return ret;
 }

[2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Adrian Bunk]

The Coverity checker spotted this obvious NULL pointer dereference 
caused by a wrong order of the cleanups.


Signed-off-by: Adrian Bunk <bunk@stusta.de>

---

This patch was already sent on:
- 23 Nov 2005
- 21 Nov 2005

--- linux-2.6.15-rc1-mm2-full/drivers/infiniband/core/mad.c.old	2005-11-20 22:04:36.000000000 +0100
+++ linux-2.6.15-rc1-mm2-full/drivers/infiniband/core/mad.c	2005-11-20 22:05:17.000000000 +0100
@@ -355,9 +355,9 @@
 	spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 	kfree(reg_req);
 error3:
-	kfree(mad_agent_priv);
-error2:
 	ib_dereg_mr(mad_agent_priv->agent.mr);
+error2:
+	kfree(mad_agent_priv);
 error1:
 	return ret;
 }

Re: [2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Roland Dreier]

Thanks, I already have this in my git tree of pending changes
(I found it by actually hitting the crash it causes with CONFIG_DEBUG_SLAB=y).

 - R.

Re: [2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Adrian Bunk]

On Sun, Nov 27, 2005 at 03:51:41PM -0800, Roland Dreier wrote:

> Thanks, I already have this in my git tree of pending changes
> (I found it by actually hitting the crash it causes with CONFIG_DEBUG_SLAB=y).

Can you Cc me when forwarding it to Linus?

After it's in Linus' tree, Greg will accept it for the 2.6.14 stable
tree.

>  - R.

TIA
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Roland Dreier]

    Adrian> Can you Cc me when forwarding it to Linus?

Looks like it went into Linus's tree directly from you (which is fine).

    Adrian> After it's in Linus' tree, Greg will accept it for the
    Adrian> 2.6.14 stable tree.

Is this really important enough for the stable tree?

 - R.

Re: [2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Adrian Bunk]

On Mon, Nov 28, 2005 at 09:59:17AM -0800, Roland Dreier wrote:
>     Adrian> Can you Cc me when forwarding it to Linus?
> 
> Looks like it went into Linus's tree directly from you (which is fine).

It went through Andrew.

>     Adrian> After it's in Linus' tree, Greg will accept it for the
>     Adrian> 2.6.14 stable tree.
> 
> Is this really important enough for the stable tree?

You said it fixed a crash for you.

Besides this, it's a small and easy to verify change.

>  - R.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [2.6 patch] drivers/infiniband/core/mad.c: fix a NULL pointer dereference

[Roland Dreier]

    Roland> Is this really important enough for the stable tree?

    Adrian> You said it fixed a crash for you.

To trigger the patch, you have to hit the error path, which in
practical terms requires buggy code calling into the function.  And
you also have to either be running with CONFIG_DEBUG_SLAB=y or be
extremely unlucky.  So I don't think anyone who's not developing IB
driver code could ever hit the crash, and any developers are going to
be running the latest tree anyway.

    Adrian> Besides this, it's a small and easy to verify change.

Sure, I don't mind it going into the stable tree.  I'm just not sure
it's worth spending everyone's time on it.

 - R.