From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753831Ab0CUVbL (ORCPT ); Sun, 21 Mar 2010 17:31:11 -0400 Received: from mgw2.diku.dk ([130.225.96.92]:41002 "EHLO mgw2.diku.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753612Ab0CUVbI (ORCPT ); Sun, 21 Mar 2010 17:31:08 -0400 Date: Sun, 21 Mar 2010 22:31:06 +0100 (CET) From: Julia Lawall To: Mark McClelland , Mauro Carvalho Chehab , linux-usb@vger.kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [PATCH] drivers/media/video: avoid NULL dereference Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Julia Lawall If ov is NULL, it will not be possible to take the lock in the first place, so move the test up earlier. The semantic match that finds the problem is as follows: (http://coccinelle.lip6.fr/) // @r exists@ expression E, E1; identifier f; statement S1,S3; iterator iter; @@ if ((E == NULL && ...) || ...) { ... when != false ((E == NULL && ...) || ...) when != true ((E != NULL && ...) || ...) when != iter(E,...) S1 when != E = E1 ( sizeof(E->f) | * E->f ) ... when any return ...; } else S3 // Signed-off-by: Julia Lawall --- drivers/media/video/ov511.c | 8 +++----- 1 files changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c index e0bce8d..2357218 100644 --- a/drivers/media/video/ov511.c +++ b/drivers/media/video/ov511.c @@ -5913,14 +5913,12 @@ ov51x_disconnect(struct usb_interface *intf) PDEBUG(3, ""); + if (!ov) + return; + mutex_lock(&ov->lock); usb_set_intfdata (intf, NULL); - if (!ov) { - mutex_unlock(&ov->lock); - return; - } - /* Free device number */ ov511_devused &= ~(1 << ov->nr);