[ofa-general] Suspicious code in schedule_nes_timer()

Roland Dreier rdreier at cisco.com
Sat Nov 1 11:44:13 PDT 2008


schedule_nes_timer() starts as follows.  Observe a couple of things:

	int schedule_nes_timer(struct nes_cm_node *cm_node, struct sk_buff *skb,
			enum nes_timer_type type, int send_retrans,
			int close_when_complete)
	{
		unsigned long  flags;
		struct nes_cm_core *cm_core = cm_node->cm_core;

>>> cm_node is directly dereferenced here...

		struct nes_timer_entry *new_send;
		int ret = 0;
		u32 was_timer_set;
	
		if (!cm_node)
			return -EINVAL;

>>> and then later tested for NULL...

so if cm_node is NULL, then the code will oops before it hits the return
-EINVAL.  It seems that callers must guarantee that cm_node isn't NULL,
so it would make sense to delete the "if (!cm_node)" test, right?

 - R.



More information about the general mailing list