Skip to content

Commit 5dc474d

Browse files
Julia Lawalldavem330
authored andcommitted
pppol2tp: Remove null pointer dereference.
If session is NULL, it is not possible to access its name field. So I have split apart the printing of the error message to drop the printing of the name field in this case. The macro PRINTK actually only evaluates its arguments starting with the third one if the bitwise conjunction of the first two is non-zero. Normally, this conjunction would only be non-zero if debugging mode were turned on, but when session is NULL, the first argument in both the old and new code is -1, and thus the bitwise conjunction is true. Perhaps a different strategy is desired, such as using tunnel->debug, which session->debug is initialized to, but tunnel can also be NULL, so this does not completely solve the problem. This problem was found using the following semantic match (http://www.emn.fr/x-info/coccinelle/) // <smpl> @@ expression E, E1; identifier f; statement S1,S2,S3; @@ * if (E == NULL) { ... when != if (E == NULL) S1 else S2 when != E = E1 * E->f ... when any return ...; } else S3 // </smpl> Signed-off-by: Julia Lawall <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 4951704 commit 5dc474d

File tree

1 file changed

+10
-3
lines changed

1 file changed

+10
-3
lines changed

drivers/net/pppol2tp.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1621,9 +1621,16 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
16211621
end:
16221622
release_sock(sk);
16231623

1624-
if (error != 0)
1625-
PRINTK(session ? session->debug : -1, PPPOL2TP_MSG_CONTROL, KERN_WARNING,
1626-
"%s: connect failed: %d\n", session->name, error);
1624+
if (error != 0) {
1625+
if (session)
1626+
PRINTK(session->debug,
1627+
PPPOL2TP_MSG_CONTROL, KERN_WARNING,
1628+
"%s: connect failed: %d\n",
1629+
session->name, error);
1630+
else
1631+
PRINTK(-1, PPPOL2TP_MSG_CONTROL, KERN_WARNING,
1632+
"connect failed: %d\n", error);
1633+
}
16271634

16281635
return error;
16291636
}

0 commit comments

Comments
 (0)