From: Jesper Juhl <jesper.juhl@gmail.com>
To: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: Gadi Oxman <gadio@netvision.net.il>,
LKML <linux-kernel@vger.kernel.org>,
Jesper Juhl <jesper.juhl@gmail.com>
Subject: [PATCH] ide-tape: Avoid potential null pointer dereference in idetape_abort_pipeline()
Date: Sat, 15 Mar 2008 01:26:44 +0100 (CET) [thread overview]
Message-ID: <alpine.LNX.1.00.0803150123450.29784@dragon.funnycrock.com> (raw)
If a NULL 'new_last_stage' is passed to idetape_abort_pipeline() then
we'll dereference a NULL pointer and go *boom*.
The function does test for a null pointer, unfortunately it only does it
after having already dereferenced it.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
---
ide-tape.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index 43e0e05..943290c 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -814,11 +814,14 @@ static void idetape_abort_pipeline(ide_drive_t *drive,
idetape_stage_t *new_last_stage)
{
idetape_tape_t *tape = drive->driver_data;
- idetape_stage_t *stage = new_last_stage->next;
+ idetape_stage_t *stage = NULL;
idetape_stage_t *nstage;
debug_log(DBG_PROCS, "%s: Enter %s\n", tape->name, __func__);
+ if (new_last_stage)
+ stage = new_last_stage->next;
+
while (stage) {
nstage = stage->next;
idetape_kfree_stage(tape, stage);
next reply other threads:[~2008-03-15 0:27 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-03-15 0:26 Jesper Juhl [this message]
2008-03-15 1:02 ` Johannes Weiner
2008-03-15 1:13 ` Jesper Juhl
2008-03-16 16:58 ` Bartlomiej Zolnierkiewicz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.LNX.1.00.0803150123450.29784@dragon.funnycrock.com \
--to=jesper.juhl@gmail.com \
--cc=bzolnier@gmail.com \
--cc=gadio@netvision.net.il \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®