* re: Ethernet driver for the WIZnet W5100 chip
@ 2012-04-10 8:40 Dan Carpenter
2012-04-11 5:53 ` [PATCH] net: WIZnet drivers: fix possible NULL dereference Mike Sinkovsky
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2012-04-10 8:40 UTC (permalink / raw)
To: msink; +Cc: netdev
Hello Mike Sinkovsky,
This is a semi-automatic email about new static checker warnings.
The patch 8b1467a31343: "Ethernet driver for the WIZnet W5100 chip"
from Apr 4, 2012, leads to the following Smatch complaint:
drivers/net/ethernet/wiznet/w5100.c:685 w5100_hw_probe()
error: we previously assumed 'data' could be null (see line 637)
drivers/net/ethernet/wiznet/w5100.c
636
637 if (data && is_valid_ether_addr(data->mac_addr)) {
^^^^
New check.
638 memcpy(ndev->dev_addr, data->mac_addr, ETH_ALEN);
639 } else {
640 random_ether_addr(ndev->dev_addr);
641 ndev->addr_assign_type |= NET_ADDR_RANDOM;
642 }
643
644 mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
645 if (!mem)
646 return -ENXIO;
647 mem_size = resource_size(mem);
648 if (!devm_request_mem_region(&pdev->dev, mem->start, mem_size, name))
649 return -EBUSY;
650 priv->base = devm_ioremap(&pdev->dev, mem->start, mem_size);
651 if (!priv->base)
652 return -EBUSY;
653
654 spin_lock_init(&priv->reg_lock);
655 priv->indirect = mem_size < W5100_BUS_DIRECT_SIZE;
656 if (priv->indirect) {
657 priv->read = w5100_read_indirect;
658 priv->write = w5100_write_indirect;
659 priv->read16 = w5100_read16_indirect;
660 priv->write16 = w5100_write16_indirect;
661 priv->readbuf = w5100_readbuf_indirect;
662 priv->writebuf = w5100_writebuf_indirect;
663 } else {
664 priv->read = w5100_read_direct;
665 priv->write = w5100_write_direct;
666 priv->read16 = w5100_read16_direct;
667 priv->write16 = w5100_write16_direct;
668 priv->readbuf = w5100_readbuf_direct;
669 priv->writebuf = w5100_writebuf_direct;
670 }
671
672 w5100_hw_reset(priv);
673 if (w5100_read16(priv, W5100_RTR) != RTR_DEFAULT)
674 return -ENODEV;
675
676 irq = platform_get_irq(pdev, 0);
677 if (irq < 0)
678 return irq;
679 ret = request_irq(irq, w5100_interrupt,
680 IRQ_TYPE_LEVEL_LOW, name, ndev);
681 if (ret < 0)
682 return ret;
683 priv->irq = irq;
684
685 priv->link_gpio = data->link_gpio;
^^^^^^^^^^^^^^^
New unchecked dereference.
686 if (gpio_is_valid(priv->link_gpio)) {
687 char *link_name = devm_kzalloc(&pdev->dev, 16, GFP_KERNEL);
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] net: WIZnet drivers: fix possible NULL dereference
2012-04-10 8:40 Ethernet driver for the WIZnet W5100 chip Dan Carpenter
@ 2012-04-11 5:53 ` Mike Sinkovsky
2012-04-13 17:34 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Mike Sinkovsky @ 2012-04-11 5:53 UTC (permalink / raw)
To: netdev, dan.carpenter, davem; +Cc: Mike Sinkovsky
This fixes possible null dereference in probe() function: when both
.mac_addr and .link_gpio are unknown, dev.platform_data may be NULL
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mike Sinkovsky <msink@permonline.ru>
---
drivers/net/ethernet/wiznet/w5100.c | 2 +-
drivers/net/ethernet/wiznet/w5300.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index c28e1d5..157d2f0 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -682,7 +682,7 @@ static int __devinit w5100_hw_probe(struct platform_device *pdev)
return ret;
priv->irq = irq;
- priv->link_gpio = data->link_gpio;
+ priv->link_gpio = data ? data->link_gpio : -EINVAL;
if (gpio_is_valid(priv->link_gpio)) {
char *link_name = devm_kzalloc(&pdev->dev, 16, GFP_KERNEL);
if (!link_name)
diff --git a/drivers/net/ethernet/wiznet/w5300.c b/drivers/net/ethernet/wiznet/w5300.c
index 88afde9..86d07bb 100644
--- a/drivers/net/ethernet/wiznet/w5300.c
+++ b/drivers/net/ethernet/wiznet/w5300.c
@@ -596,7 +596,7 @@ static int __devinit w5300_hw_probe(struct platform_device *pdev)
return ret;
priv->irq = irq;
- priv->link_gpio = data->link_gpio;
+ priv->link_gpio = data ? data->link_gpio : -EINVAL;
if (gpio_is_valid(priv->link_gpio)) {
char *link_name = devm_kzalloc(&pdev->dev, 16, GFP_KERNEL);
if (!link_name)
--
1.6.3.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] net: WIZnet drivers: fix possible NULL dereference
2012-04-11 5:53 ` [PATCH] net: WIZnet drivers: fix possible NULL dereference Mike Sinkovsky
@ 2012-04-13 17:34 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2012-04-13 17:34 UTC (permalink / raw)
To: msink; +Cc: netdev, dan.carpenter
From: Mike Sinkovsky <msink@permonline.ru>
Date: Wed, 11 Apr 2012 11:53:53 +0600
> This fixes possible null dereference in probe() function: when both
> .mac_addr and .link_gpio are unknown, dev.platform_data may be NULL
>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Mike Sinkovsky <msink@permonline.ru>
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-04-13 17:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-04-10 8:40 Ethernet driver for the WIZnet W5100 chip Dan Carpenter
2012-04-11 5:53 ` [PATCH] net: WIZnet drivers: fix possible NULL dereference Mike Sinkovsky
2012-04-13 17:34 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.