Commit Graph
100 Commits
Author SHA1 Message Date
Eric Sesterhenn 0b3a82d391 [SCSI] lpfc: check before dereference in lpfc_ct.c
If we fail to allocate mp->virt during the first while loop iteration,
mlist is still uninitialized, therefore we should check if before
dereferencing.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: James Smart <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
2006-10-25 15:12:34 -07:00
Eric Sesterhenn f84fcb06a1 Remove unnecessary check in drivers/video/intelfb/intelfbhw.c
All callers and the function itself dereference dinfo, so we can remove the
check.  (coverity id #1371)

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
2006-10-25 12:05:18 -07:00
Eric Sesterhenn 9ef9977cab pciehp: Remove unnecessary check in pciehp_ctrl.c
this was spotted by coverity (cid #819). We dereference p_slot
earlier in the function, and i found no way it could become NULL
anywhere.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-10-18 11:36:10 -07:00
Eric Sesterhenn 0e185b7922 USB: Memory leak in drivers/usb/serial/airprime.c
the commit
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=5dda171202f94127e49c12daf780cdae1b4e668b
added a memory leak.  In case we cant allocate an urb, we dont free the
buffer and leak it.  Coverity id #1438

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Andy Gay <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-10-17 14:46:33 -07:00
Eric Sesterhenn a65dc301c7 USB: fix dereference in drivers/usb/misc/adutux.c
in two of the error cases, dev is still NULL,
and we dereference it. Spotted by coverity (cid#1428, 1429)

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Randy Dunlap <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-10-17 14:46:33 -07:00
Eric Sesterhenn 2daa48729d USB: fix use after free in wacom_sys.c
the following commit added a use after free
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3D3bea733ab21247290bd552dd6a2cd3049af9adef
Found by coverity (cid #1441)

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: "Ping Cheng" <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-10-17 14:46:30 -07:00
Eric Sesterhenn 2920349d43 USB: BUG_ON conversion for wacom.c
this patch converts two if () BUG(); construct to BUG_ON();
which occupies less space, uses unlikely and is safer when
BUG() is disabled.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: "Ping Cheng" <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-10-17 14:46:30 -07:00
Eric Sesterhenn 683f8c9e00 [PATCH] zd1201: Possible NULL dereference
If we enter the if(!zd) and set free to 1, we dereference zd in the exit
code.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
2006-10-16 20:09:48 -04:00
Eric Sesterhenn bb579cf1d4 [POWERPC] Off-by-one in /arch/ppc/platforms/mpc8*
A find -iname \*.[ch] | xargs grep "> ARRAY_SIZE(" revealed several
incorrect usages of ARRAY_SIZE in the mpc drivers.  The last element in the
array is always ARRAY_SIZE()-1, this patch modifies the bounds checks
accordingly.

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Vitaly Bordug <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Paul Mackerras <[email protected]>
2006-10-16 15:52:14 +10:00
Eric Sesterhenn 97e860d364 [PATCH] Remove unnecessary check in fs/fat/inode.c
Aince all callers dereference sb, and this function does so earlier too, we
dont need the check.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: OGAWA Hirofumi <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-10-11 11:14:23 -07:00
Eric Sesterhenn 41716c7c21 [PATCH] null dereference in fs/jbd/journal.c
Since commit d1807793e1 we dereference a NULL
pointer.  Coverity id #1432.  We set journal to NULL, and use it directly
afterwards.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-10-11 11:14:14 -07:00
Eric Eric Sesterhenn 00079e04fe [PATCH] reiserfs: null pointer dereferencing in reiserfs_read_bitmap_block
null pointer dereferencing in reiserfs_read_bitmap_block.

Signed-off-by: Alexander Zarochentsev <[email protected]>
Cc: Jeff Mahoney <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-10-07 10:51:14 -07:00
Eric Sesterhenn 92b93d3171 [ALSA] Fix memory leak in sound/isa/es18xx.c
Fixed a memory leak in the error patch.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Jaroslav Kysela <[email protected]>
2006-10-06 20:22:58 +02:00
Eric Sesterhenn 585b7747d6 [PATCH] Remove unnecessary check in fs/reiserfs/inode.c
Since all callers dereference dir, we dont need this check.  Coverity id
#337.

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Jeff Mahoney <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-10-04 07:55:14 -07:00
Eric Sesterhenn 9ab5aa911a BUG_ON conversion for fs/xfs/
This patch converts two if () BUG(); construct to BUG_ON();
which occupies less space, uses unlikely and is safer when
BUG() is disabled.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-10-03 23:37:55 +02:00
Eric Sesterhenn 73dff8be9e BUG_ON() conversion in fs/nfsd/
This patch converts an if () BUG(); construct to BUG_ON();
which occupies less space, uses unlikely and is safer when
BUG() is disabled.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-10-03 23:37:14 +02:00
Eric Sesterhenn 14a61442c2 BUG_ON conversion for fs/reiserfs
This patch converts several if () BUG(); construct to BUG_ON();
which occupies less space, uses unlikely and is safer when
BUG() is disabled. S_ISREG() has no side effects, so the
conversion is safe.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-10-03 23:36:38 +02:00
Eric Sesterhenn 8d8f3cbe77 BUG_ON cleanups in arch/i386
This changes a couple of if() BUG(); constructs to
BUG_ON(); so it can be safely optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-10-03 23:34:58 +02:00
Eric Sesterhenn 644c12d7f6 BUG_ON cleanup in drivers/net/tokenring/
This patch converts one if() BUG(); to BUG_ON();
so it can be safely optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-10-03 23:34:11 +02:00
Eric Sesterhenn 52e5f9d1cf BUG_ON cleanup for drivers/md/
This changes two if() BUG(); usages to BUG_ON(); so people
can disable it safely.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-10-03 23:33:23 +02:00
Eric Sesterhenn 80c6e3c0b5 [SCSI] fix scsi_device_types overrun in scsi.c
this overrun was spotted by coverity (cid #1403).

If type == ARRAY_SIZE(scsi_device_types), we are off by one.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
2006-10-01 15:04:48 -05:00
Eric Sesterhenn 397d6140e9 [PATCH] Remove unnecessary check in drivers/rtc/rtc-v3020.c
Looks like the probe function always gets a valid pdev, and checking it
after dereferencing it is pretty useless.  This patch removes the check
(cid #1365)

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Alessandro Zummo <[email protected]>
Cc: Raphael Assenat <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-10-01 00:39:24 -07:00
Eric Sesterhenn 095d030cff [PATCH] Off-by-one in drivers/char/mwave/mwavedd.c
This fixes two off by ones in the mwave driver, found
via find -iname \*.[ch] | xargs grep "> ARRAY_SIZE("

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-10-01 00:39:24 -07:00
Eric Sesterhenn 8c6ba51bda [PATCH] Uninitialized variable in drivers/net/wan/syncppp.c
For len equal to 4, we never call sppp_lcp_conf_parse_options(),
therefore rmagic does not get initialized.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Paul Fulghum <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-09-29 09:18:23 -07:00
Eric Sesterhenn 1811474620 [SUNRPC]: Remove unnecessary check in net/sunrpc/svcsock.c
coverity spotted this one as possible dereference in the dprintk(),
but since there is only one caller of svc_create_socket(), which always
passes a valid sin, we dont need this check.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2006-09-28 18:03:06 -07:00
Eric Sesterhenn 9918f23096 [RTNETLINK]: Possible dereference in net/core/rtnetlink.c
another possible dereference spotted by coverity (#cid 1390).
if the nlmsg_parse() call fails, we goto errout, where we call
dev_put(), with dev still initialized to NULL.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2006-09-28 18:01:23 -07:00
Eric Sesterhenn 44334bd97e RDMA/amso1100: Fix error path in c2_llp_accept()
Another NULL dereference spotted by the Coverity checker (cid #1395):
In case we can't alloc the vq_req, we goto bail1, where we call
vq_req_free(c2dev, vq_req); which then dereferences vq_req.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Acked-by: Tom Tucker <[email protected]>
Signed-off-by: Roland Dreier <[email protected]>
2006-09-28 10:38:32 -07:00
Eric Sesterhenn d1d8f7dec1 [ARM] Off-by-one in arch/arm/common/icst*
hi,

a quick find -iname \*.[ch] | xargs grep "> ARRAY_SIZE(", revealed
these in the icst drivers.
If i == ARRAY_SIZE, we get past the idx2s array.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Russell King <[email protected]>
2006-09-27 23:17:54 +01:00
Eric Sesterhenn 55359021b9 USB: fix signedness issue in drivers/usb/gadget/ether.c
another gcc 4.1 signdness warning:

drivers/usb/gadget/ether.c:2028: warning: comparison of unsigned expression < 0 is always false

length is assigned the value of usb_ep_queue() which returns an int.
Directly after this it is checked for < 0, which can never be true.  Making
length an int makes the error check work again.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: David Brownell <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-09-27 11:58:55 -07:00
Eric Sesterhenn a2a65a3ecb [SCSI] Signedness issue in drivers/scsi/ipr.c
gcc 4.1 with some extra warnings show the following:

drivers/scsi/ipr.c:6361: warning: comparison of unsigned expression < 0 is always false
drivers/scsi/ipr.c:6385: warning: comparison of unsigned expression < 0 is always false
drivers/scsi/ipr.c:6415: warning: comparison of unsigned expression < 0 is always false

The problem is that rc is of the type u32, which can never be smaller than
zero, therefore all three error handling checks get useless.  This patch
changes it to a normal int, because all usages / all functions it get used
with expect an int.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Brian King <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
2006-09-26 11:35:36 -07:00
Eric Sesterhenn 45223fd77c [SCSI] Signdness issue in drivers/scsi/osst.c
another signdness warning from gcc 4.1

drivers/scsi/osst.c:5154: warning: comparison of unsigned expression < 0 is always false

The problem is that blk is defined as unsigned, but all usages of it are
normal int cases.  osst_get_frame_position() and osst_get_sector() return ints
and can return negative values.  If blk stays an unsigned int, the error check
is useless.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
2006-09-26 11:35:28 -07:00
Eric Sesterhenn d084aa7067 V4L/DVB (4510): Fix signedness error in drivers/media/video/vivi.c
when checking the -Wextra signedness warnings issued by gcc 4.1
I came across this one:
drivers/media/video/vivi.c:1001: warning: comparison of unsigned expression < 0 is always false
Since videobuf_reqbufs() returns negative values on errors the current
code does no real error checking since gcc removes the comparison.
This patch fixes this issue by making ret a normal, signed integer.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2006-09-26 12:30:32 -03:00
Eric Sesterhenn 84c22d7901 [PATCH] Signedness issue in drivers/net/phy/phy_device.c
While checking gcc 4.1 -Wextra warnings, I stumbled across the following
two warnings:

drivers/net/phy/phy_device.c:528: warning: comparison of unsigned expression < 0 is always false
drivers/net/phy/phy_device.c:546: warning: comparison of unsigned expression < 0 is always false

Since phy_read() returns an integer and can return negative values, it seems
to me the best way to get proper error handling working again is to make val
an int.  Currently it is an u32, so the < 0 check always fails.

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Jeff Garzik <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
2006-09-25 20:01:19 -04:00
Eric Sesterhenn cb958186ed [PATCH] Signedness issue in drivers/net/3c515.c
while playing with gcc 4.1 -Wextra warnings, I came across this one:

drivers/net/3c515.c:1027: warning: comparison of unsigned expression >= 0 is always true

Since i is unsigned the >= 0 check in the for loop is always true,
so we might spin there forever unless the if condition triggers.
Since i is only used in this loop, this patch changes it to
an integer.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
2006-08-24 00:37:04 -04:00
Eric Sesterhenn 053be305d3 [PATCH] USB: fix pointer dereference in drivers/usb/misc/usblcd
coverity spotted (id #185) that we still use urb, if the allocation
fails in the error path. This patch fixes this by returning directly.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-07-12 16:03:23 -07:00
Eric Sesterhenn cb6dd26097 [ALSA] Memory leak in sound/pcmcia/pdaudiocf/pdaudiocf.c
if one of the first three CS_CHECKS fails, we goto cs_failed:
In this case parse we donr kfree() parse. Since the the last three
CS_CHECKS might also fail, i moved the kfree() below all the CS_CHECKs
and added one in the error path. This fixes coverity bug id #1099

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
Signed-off-by: Jaroslav Kysela <[email protected]>
2006-07-12 20:07:23 +02:00
Eric Sesterhenn cd6b3956e9 [PATCH] isdn: cleanup i_rdev udage
Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Alexey Dobriyan <[email protected]>
Cc: Karsten Keil <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-07-10 13:24:27 -07:00
Eric Sesterhenn 2017b376c0 [PATCH] aoe: cleanup i_rdev usage
Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Alexey Dobriyan <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-07-10 13:24:25 -07:00
Eric Sesterhenn 32ea086b7b [PATCH] cris: switch to iminor/imajor
Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Alexey Dobriyan <[email protected]>
Cc: Mikael Starvik <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-07-10 13:24:22 -07:00
Eric Sesterhenn 60d48f1e23 [PATCH] skb used after passing to netif_rx in net/ieee80211/ieee80211_rx.c
this patch fixes coverity id #913. ieee80211_monitor_rx() passes the skb
to netif_rx() and we should not reference it any longer.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
2006-07-05 13:42:57 -04:00
Eric Sesterhenn 91a079196f V4L/DVB (4289): Missing statement in drivers/media/dvb/frontends/cx22700.c
Stumbled over this because of coverity (id #492),
seems like we are missing a return statement here and fail
to do proper bounds checking. If this assumption is false
we should at least change the identation to make it clear

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2006-06-30 15:59:51 -03:00
Eric Sesterhenn d81931d9a2 [PATCH] SKB leak in drivers/isdn/i4l/isdn_x25iface.c
Coverity spotted this leak (id #613), when we are not configured, we return
without freeing the allocated skb.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Karsten Keil <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-29 10:26:21 -07:00
Eric Sesterhenn 8e53cfc8f2 [PATCH] Deref in drivers/block/paride/pf.c
Another possible dereference detected by coverity (id #759).  pf_probe()
might call pf_identify() which might call get_capacity() which dereferences
pf->disk

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-29 10:26:20 -07:00
Eric Sesterhenn 0a3a6d69b7 Input: db9 - fix potential buffer overrun
Fixes Coverity #id 483

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>
2006-06-27 23:42:33 -04:00
Eric Sesterhenn 73024cf115 [XFS] Fix realtime subvolume expansion, a porting bug b0rked it. Coverity
made me look at this code (bug id #344). We only return with
XFS_ERROR(EINVAL) if mp->m_rtdev_targp is valid and pass it otherwise to
xfs_read_buf() where some function calls later it gets dereferenced by an
assert.

SGI-PV: 954266
SGI-Modid: xfs-linux-melb:xfs-kern:26363a

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Nathan Scott <[email protected]>
2006-06-28 08:42:26 +10:00
Eric Sesterhenn 5fd571cbc1 [PATCH] Array overrun in drivers/infiniband/core/cma.c
This was spotted by coverity #id 1300.  Since the array has only four
elements, we should just use those four.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Sean Hefty <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-26 11:57:28 -07:00
Eric Sesterhenn 9f13fae247 [PATCH] Fix typo in drivers/isdn/hisax/q931.c
This fixes coverity bug #517.

Since IESIZE is greater than IESIZE_NI1 we might run past the end of
ielist_ni1.  This fixes it by using the proper IESIZE_NI1 define.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Karsten Keil <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-26 09:58:23 -07:00
Eric Sesterhenn 3ac90216ab [TIPC] Fix for NULL pointer dereference
This fixes a bug spotted by the coverity checker, bug id #366. If
(mod(seqno - prev) != 1) we set buf to NULL, dereference it in the for
case, and set it to whatever value happes to be at adress 0+next, if it
happens to be non-zero, we even stay in the loop. It seems that the author
intended to break there.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Per Liden <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2006-06-25 23:41:15 -07:00
Eric Sesterhenn 099a71d995 [PATCH] Remove needless checks in fs/9p/vfs_inode.c
coverity found two needless checks in vfs_inode.c (cid #1165 and #1164)
In both cases inode is always NULL when we goto error; either because it
is still initialized to NULL or is set to NULL explicitly. This patch
simply removes these checks to save some code.

Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Eric Van Hensbergen <[email protected]>
Cc: Ron Minnich <[email protected]>
Cc: Latchesar Ionkov <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-25 10:01:20 -07:00
Eric Sesterhenn 326f28e9ec [PATCH] More !tty cleanups in drivers/char
Another bunch of checks in the char drivers .put_char() and .write()
routines, where tty can never be NULL.  This patch removes these checks to
save some code.  Coverity choked at those with the following bug ids:

isicom.c  767, 766
specialix.c 773, 774
synclink_cs.c 779, 781
synclink_gt.c 784, 785
synclinkmp.c 784, 785

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Paul Fulghum <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-25 10:01:19 -07:00
Eric Sesterhenn a2f20c7c27 [PATCH] Clean up char/esp.c
coverity choked at another two !tty checks, in places where tty can
never be NULL. Since it removes some code we should remove
these checks. (Coverity ids #763,#762)

Signed-off-by Eric Sesterhenn <[email protected]>

Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-25 10:01:17 -07:00
Eric Sesterhenn 969dd061d8 [PATCH] Cyclades Cleanup
coverity choked at two !tty checks, in places where tty can never be NULL.
Since it removes some code we should remove these checks.  (Coverity ids
#763,#762)

[[email protected]: even cleaner!]
Signed-off-by: Eric Sesterhenn <[email protected]>
Acked-by: Alan Cox <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-25 10:01:17 -07:00
Eric Sesterhenn 845f16abad V4L/DVB (4070): Zoran strncpy() fix
The zoran driver uses strncpy() in an unsafe way.  This patch uses the proper
sizeof()-1 size parameter.  Since all strncpy() targets are initialised with
memset() the trailing '\0' is already set.  Where std->name was the target for
the strncpy() we overwrote 8 Bytes of the std structure with zeros.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2006-06-25 02:05:05 -03:00
Eric Sesterhenn 125e18745f [PATCH] More BUG_ON conversion
Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Alexey Dobriyan <[email protected]>
Cc: Bartlomiej Zolnierkiewicz <[email protected]>
Cc: Alan Cox <[email protected]>
Cc: James Bottomley <[email protected]>
Acked-by: "Salyzyn, Mark" <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-06-23 07:43:08 -07:00
Eric Sesterhenn 6d56ab9362 [PATCH] Dereference in tokenring/olympic.c
hi,

coverity found (bug id #225) that we might call free_netdev()
with NULL argument, when alloc_trdev() fails. This patch
changes the goto, so we dont call free_netdev() for
dev == NULL.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
2006-06-22 23:24:18 -04:00
Eric Sesterhenn a192491ad5 [PATCH] Array overrun in drivers/net/wireless/wavelan.c
hi,

this is another array overrun spotted by coverity (#id 507)
we should check the index against array size before using it.
Not sure why the driver doesnt use ARRAY_SIZE instead of its
own macro.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
2006-06-22 23:24:18 -04:00
Eric Sesterhenn da4f5ccf60 [PATCH] Remove useless check in drivers/net/pcmcia/xirc2ps_cs.c
hi,

coverity choked at this check (id #223), assuming that
skb might be NULL and used anyways later. Since
start_hard_xmit() always gets called with a valid
skb, the check is useless and this patch removes it.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
2006-06-22 23:22:17 -04:00
Eric Sesterhenn d20cad602f [ALSA] NULL pointer dereference in sound/synth/emux/soundfont.c
this is about coverity id #100.
It seems the if statement is negated, since the else branch calls
remove_info() with sflist->currsf as a parameter where it gets
dereferenced.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
2006-06-22 21:34:05 +02:00
Eric Sesterhenn d5ce1379be [PATCH] USB: negative index in drivers/usb/host/isp116x-hcd.c
From: Eric Sesterhenn <[email protected]>

This fixes coverity Bug #390.

With the following code

	ret = ep->branch = balance(isp116x, ep->period, ep->load);
	if (ret < 0)
		goto fail;

the problem is that ret and balance are of the type int, and ep->branch is u16.
so the int balance() returns gets reduced to u16 and then converted to an int again,
which removes the sign. Maybe the following little c program can explain it better:
2006-06-21 15:04:15 -07:00
Eric Sesterhenn 9df7fde52c [PATCH] PCI Hotplug: fake NULL pointer dereferences in IBM Hot Plug Controller Driver
Remove checks for value, since the hotplug core always provides
a valid value.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
2006-06-19 14:13:24 -07:00
Eric Sesterhenn a6a61c5494 [PATCH] Overrun in isdn_tty.c
This fixes coverity bug id #1237.  After the while loop, it is possible for
i == ISDN_LMSNLEN.  If this happens the terminating '\0' is written after
the end of the array.

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Karsten Keil <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-05-21 12:59:18 -07:00
Eric Sesterhenn 7c908fbb01 V4L/DVB (3790): Use after free in drivers/media/video/em28xx/em28xx-video.c
In several places we use dev->devno right after we kfree() dev.  This fixes
coverity bug id #1065

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
2006-05-12 19:54:59 -03:00
Eric Sesterhenn d698f1c726 [PATCH] fix array overrun in drivers/char/mwave/mwavedd.c
this fixes coverity id #489.

Since the last element in the array is always ARRAY_SIZE-1 we have to check
for ipcnum >= ARRAY_SIZE()

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-04-28 08:33:46 -07:00
Eric Sesterhenn 1a34456bbb [SCSI] Overrun in drivers/scsi/sim710.c
This fixes coverity bug id #480.  Since id_array is declared as
id_array[MAX_SLOTS], the check for i>MAX_SLOTS is obviously false.

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: James Bottomley <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: James Bottomley <[email protected]>
2006-04-19 20:51:38 -04:00
Eric Sesterhenn a5f9145bc9 SUNRPC: Dead code in net/sunrpc/auth_gss/auth_gss.c
Hi,

the coverity checker spotted that cred is always NULL
when we jump to out_err ( there is just one case, when
we fail to allocate the memory for cred )
This is Coverity ID #79

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Trond Myklebust <[email protected]>
2006-04-19 13:06:49 -04:00
Eric Sesterhenn 2462321bfe [ALSA] Overrun in sound/pci/au88x0/au88x0_pcm.c
Modules: au88x0 driver

since idx is used as an index for vortex_pcm_prettyname[VORTEX_PCM_LAST],
it should not be equal to VORTEX_PCM_LAST. This fixes coverity bug id #572

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>
2006-04-12 11:34:17 +02:00
Eric Sesterhenn 052bb88e18 [ISDN]: Static overruns in drivers/isdn/i4l/isdn_ppp.c
Coverity found some static overruns in isdn_ppp.c (bug id #519) At several
places slot is compared <0 and > ISDN_MAX_CHANNELS and then used to index
ippp_table[ISDN_MAX_CHANNELS] A value of slot = ISDN_MAX_CHANNELS would run
over the end of the array.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2006-04-11 17:29:17 -07:00
Eric Sesterhenn b8282dcf04 [DCCP]: Fix leak in net/dccp/ipv4.c
we dont free req if we cant parse the options.
This fixes coverity bug id #1046

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2006-04-11 17:21:06 -07:00
Eric Sesterhenn d93c2efc93 [PATCH] Overrun in cdrom/aztcd.c
This fixes coverity bug id #473.  After the for loop i==16 if we didn't find a
cdrom.  So we should check for i==16 first before checking the array element.

Signed-off-by: Eric Sesterhenn <[email protected]>
Cc: Jens Axboe <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-04-11 06:18:46 -07:00
Eric Sesterhenn e60b6e2f74 [PATCH] Wrong out of range check in drivers/char/applicom.c
This fixes coverity bug id #469.  The out of range check didnt work as
intended, as seen by the printk(), which states that boardno has to be 1 <=
boardno <= MAX_BOARD.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
2006-04-11 06:18:46 -07:00
Eric Sesterhenn eaaae38c1a kbuild: fix NULL dereference in scripts/mod/modpost.c
before is NULL in this case, concluding from the surrounding code
it seems that after is the right one to use.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Sam Ravnborg <[email protected]>
2006-04-11 13:37:07 +02:00
Eric Sesterhenn cbca692c24 [PATCH] Bogus NULL pointer check in fs/configfs/dir.c
We check the "group" pointer after we dereference it.  This check is
bogus, as it cannot be NULL coming in.

Signed-off-by: Joel Becker <[email protected]>
Signed-off-by: Mark Fasheh <[email protected]>
2006-04-10 11:16:17 -07:00
Eric Sesterhenn cdee5751bf [BLUETOOTH] sco: Possible double free.
this fixes coverity bug id #1068.
hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
Since it returns a negative error value only in this case, we
can directly return here.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
2006-04-09 22:25:29 -07:00
Eric Sesterhenn 5d9428de1a BUG_ON() Conversion in drivers/net/
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:52:48 +02:00
Eric Sesterhenn 7e99e9b663 BUG_ON() Conversion in drivers/s390/net/lcs.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:50:14 +02:00
Eric Sesterhenn 40094fa652 BUG_ON() Conversion in mm/slab.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:49:25 +02:00
Eric Sesterhenn 75babcaced BUG_ON() Conversion in mm/highmem.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:47:35 +02:00
Eric Sesterhenn 9f31252cb6 BUG_ON() Conversion in kernel/signal.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:45:55 +02:00
Eric Sesterhenn fda8bd78a1 BUG_ON() Conversion in kernel/signal.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:44:47 +02:00
Eric Sesterhenn 524223ca81 BUG_ON() Conversion in kernel/ptrace.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:43:40 +02:00
Eric Sesterhenn 9ba025f108 BUG_ON() Conversion in ipc/shm.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:42:42 +02:00
Eric Sesterhenn 7ec7073809 BUG_ON() Conversion in fs/freevxfs/
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:41:02 +02:00
Eric Sesterhenn 2c2111c2bd BUG_ON() Conversion in fs/udf/
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:40:13 +02:00
Eric Sesterhenn d6735bfcc9 BUG_ON() Conversion in fs/sysv/
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:39:21 +02:00
Eric Sesterhenn b7542f8c7e BUG_ON() Conversion in fs/inode.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner and can better optimized away

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:38:18 +02:00
Eric Sesterhenn f6298aab2e BUG_ON() Conversion in fs/fcntl.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner and can better optimized away

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:37:19 +02:00
Eric Sesterhenn 8abf6a4707 BUG_ON() Conversion in fs/dquot.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner and can better optimized away

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:36:13 +02:00
Eric Sesterhenn b638548384 BUG_ON() Conversion in md/raid10.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner and can better optimized away

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:34:29 +02:00
Eric Sesterhenn 43dab9bbe9 BUG_ON() Conversion in md/raid6main.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner and can better optimized away

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:33:30 +02:00
Eric Sesterhenn 78bafebd46 BUG_ON() Conversion in md/raid5.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner and can better optimized away

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-02 13:31:42 +02:00
Eric Sesterhenn 3a8dc8930e BUG_ON() Conversion in drivers/s390/char/tape_block.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:28:11 +02:00
Eric Sesterhenn e048a8a688 BUG_ON() Conversion in drivers/s390/block/dasd_erp.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:27:08 +02:00
Eric Sesterhenn 5aae277ed6 BUG_ON() Conversion in mm/vmalloc.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:26:09 +02:00
Eric Sesterhenn e74ca2b49b BUG_ON() Conversion in mm/swap_state.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:25:12 +02:00
Eric Sesterhenn 46a350ef98 BUG_ON() Conversion in mm/mmap.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:23:29 +02:00
Eric Sesterhenn 8abd8e298e BUG_ON() Conversion in kernel/printk.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:21:17 +02:00
Eric Sesterhenn 9bc98fc6fd BUG_ON() Conversion in ipc/util.c
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:20:23 +02:00
Eric Sesterhenn 99cee0cd75 BUG_ON() Conversion in fs/sysfs/
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:18:38 +02:00
Eric Sesterhenn 5df0d31241 BUG_ON() Conversion in fs/smbfs/
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:16:26 +02:00
Eric Sesterhenn 4b4d1cc733 BUG_ON() Conversion in fs/jffs2/
this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn <[email protected]>
Signed-off-by: Adrian Bunk <[email protected]>
2006-04-01 01:15:35 +02:00