| User: | Jiri Slaby |
| Error type: | Invalid Pointer Dereference |
| Error type description: | A pointer which is invalid is being dereferenced |
| File location: | drivers/char/rio/rioroute.c |
| Line in file: | 930 |
| Project: | Linux Kernel |
| Project version: | 2.6.28 |
| Tools: |
Smatch
(1.59)
|
| Entered: | 2013-09-11 08:47:26 UTC |
900 /* 901 ** Scan all entries of the host mapping table for free slots. 902 ** We scan for free slots first and then if that is not successful 903 ** we start all over again looking for tentative slots we can re-use. 904 */ 905 for (unit = 0; unit < MAX_RUP; unit++) { 906 rio_dprintk(RIO_DEBUG_ROUTE, "Scanning unit %d\n", unit); 907 /* 908 ** If the flags are zero then the slot is empty. 909 */ 910 if (HostP->Mapping[unit].Flags == 0) { 911 rio_dprintk(RIO_DEBUG_ROUTE, " This slot is empty.\n"); 912 /* 913 ** If we haven't allocated the first ID then do it now. 914 */ 915 if (*pID1 == MAX_RUP) { 916 rio_dprintk(RIO_DEBUG_ROUTE, "Make tentative entry for first unit %d\n", unit); 917 *pID1 = unit; 918 919 /* 920 ** If the second ID is not needed then we can return 921 ** now. 922 */ 923 if (pID2 == NULL) 924 return 0; 925 } else { 926 /* 927 ** Allocate the second slot and return. 928 */ 929 rio_dprintk(RIO_DEBUG_ROUTE, "Make tentative entry for second unit %d\n", unit); 930 *pID2 = unit; 931 return 0; 932 } 933 } 934 } 935 936 /* 937 ** If we manage to come out of the free slot loop then we 938 ** need to start all over again looking for tentative slots 939 ** that we can re-use. 940 */