| Message ID | 20221116021437.145204-1-tanghui20@huawei.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v4] net: mvpp2: fix possible invalid pointer dereference | expand |
On Wed, 16 Nov 2022 10:14:37 +0800 Hui Tang wrote: > It will cause invalid pointer dereference to priv->cm3_base behind, > if PTR_ERR(priv->cm3_base) in mvpp2_get_sram(). > > Fixes: a59d354208a7 ("net: mvpp2: enable global flow control") > Signed-off-by: Hui Tang <tanghui20@huawei.com> Please do not repost new versions so often: https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr do not use --in-reply-to > diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c > index d98f7e9a480e..efb582b63640 100644 > --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c > +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c > @@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev, > struct mvpp2 *priv) > { > struct resource *res; > + void __iomem *base; > > res = platform_get_resource(pdev, IORESOURCE_MEM, 2); > if (!res) { > @@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev, > return 0; > } > > - priv->cm3_base = devm_ioremap_resource(&pdev->dev, res); > + base = devm_ioremap_resource(&pdev->dev, res); > + if (!IS_ERR(base)) > + priv->cm3_base = base; > > - return PTR_ERR_OR_ZERO(priv->cm3_base); > + return PTR_ERR_OR_ZERO(base); Use the idiomatic error handling, keep success path un-indented: ptr = function(); if (IS_ERR(ptr)) return PTR_ERR(ptr); priv->bla = ptr; return 0;
On 2022/11/16 12:28, Jakub Kicinski wrote: > On Wed, 16 Nov 2022 10:14:37 +0800 Hui Tang wrote: >> It will cause invalid pointer dereference to priv->cm3_base behind, >> if PTR_ERR(priv->cm3_base) in mvpp2_get_sram(). >> >> Fixes: a59d354208a7 ("net: mvpp2: enable global flow control") >> Signed-off-by: Hui Tang <tanghui20@huawei.com> > > Please do not repost new versions so often: > > https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr > > do not use --in-reply-to Thanks for pointing out, but should I resend it with [PATCH net v3] or [PATCH net v5]? >> diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c >> index d98f7e9a480e..efb582b63640 100644 >> --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c >> +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c >> @@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev, >> struct mvpp2 *priv) >> { >> struct resource *res; >> + void __iomem *base; >> >> res = platform_get_resource(pdev, IORESOURCE_MEM, 2); >> if (!res) { >> @@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev, >> return 0; >> } >> >> - priv->cm3_base = devm_ioremap_resource(&pdev->dev, res); >> + base = devm_ioremap_resource(&pdev->dev, res); >> + if (!IS_ERR(base)) >> + priv->cm3_base = base; >> >> - return PTR_ERR_OR_ZERO(priv->cm3_base); >> + return PTR_ERR_OR_ZERO(base); > > Use the idiomatic error handling, keep success path un-indented: > > ptr = function(); > if (IS_ERR(ptr)) > return PTR_ERR(ptr); > > priv->bla = ptr; > return 0; > > Ok, I will fix it in next version
> Thanks for pointing out, but should I resend it with [PATCH net v3] > or [PATCH net v5]? The number should always increment. It is how we tell older versions from newer versions. Andrew
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index d98f7e9a480e..efb582b63640 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev, struct mvpp2 *priv) { struct resource *res; + void __iomem *base; res = platform_get_resource(pdev, IORESOURCE_MEM, 2); if (!res) { @@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev, return 0; } - priv->cm3_base = devm_ioremap_resource(&pdev->dev, res); + base = devm_ioremap_resource(&pdev->dev, res); + if (!IS_ERR(base)) + priv->cm3_base = base; - return PTR_ERR_OR_ZERO(priv->cm3_base); + return PTR_ERR_OR_ZERO(base); } static int mvpp2_probe(struct platform_device *pdev)
It will cause invalid pointer dereference to priv->cm3_base behind, if PTR_ERR(priv->cm3_base) in mvpp2_get_sram(). Fixes: a59d354208a7 ("net: mvpp2: enable global flow control") Signed-off-by: Hui Tang <tanghui20@huawei.com> --- v1 -> v2: patch title include target v2 -> v3: keep priv->cm3_base NULL if devm_ioremap_resource() failed v3 -> v4: change if (priv->cm3_base) to if (base) --- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)