* [PATCH]rionet: fix NULL pointer dereference in rionet_remove
@ 2011-06-26 4:12 Yinglin Luan
2011-06-29 12:57 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: Yinglin Luan @ 2011-06-26 4:12 UTC (permalink / raw)
To: netdev; +Cc: davem, mporter, jj, cmdkhh, synmyth
Function rionet_remove initializes local variable 'ndev' to NULL
and do nothing changes before the call to unregister_netdev(ndev),
this could cause a NULL pointer dereference.
Reported-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Yinglin Luan <synmyth@gmail.com>
---
drivers/net/rionet.c | 28 +++++++++++++++-------------
1 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 77c5092..5d3436d 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -378,7 +378,7 @@ static int rionet_close(struct net_device *ndev)
static void rionet_remove(struct rio_dev *rdev)
{
- struct net_device *ndev = NULL;
+ struct net_device *ndev = rio_get_drvdata(rdev);
struct rionet_peer *peer, *tmp;
free_pages((unsigned long)rionet_active, rdev->net->hport->sys_size ?
@@ -433,22 +433,12 @@ static const struct net_device_ops rionet_netdev_ops = {
.ndo_set_mac_address = eth_mac_addr,
};
-static int rionet_setup_netdev(struct rio_mport *mport)
+static int rionet_setup_netdev(struct rio_mport *mport, struct net_device *ndev)
{
int rc = 0;
- struct net_device *ndev = NULL;
struct rionet_private *rnet;
u16 device_id;
- /* Allocate our net_device structure */
- ndev = alloc_etherdev(sizeof(struct rionet_private));
- if (ndev == NULL) {
- printk(KERN_INFO "%s: could not allocate ethernet device.\n",
- DRV_NAME);
- rc = -ENOMEM;
- goto out;
- }
-
rionet_active = (struct rio_dev **)__get_free_pages(GFP_KERNEL,
mport->sys_size ? __fls(sizeof(void *)) + 4 : 0);
if (!rionet_active) {
@@ -504,11 +494,21 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
int rc = -ENODEV;
u32 lpef, lsrc_ops, ldst_ops;
struct rionet_peer *peer;
+ struct net_device *ndev = NULL;
/* If local device is not rionet capable, give up quickly */
if (!rionet_capable)
goto out;
+ /* Allocate our net_device structure */
+ ndev = alloc_etherdev(sizeof(struct rionet_private));
+ if (ndev == NULL) {
+ printk(KERN_INFO "%s: could not allocate ethernet device.\n",
+ DRV_NAME);
+ rc = -ENOMEM;
+ goto out;
+ }
+
/*
* First time through, make sure local device is rionet
* capable, setup netdev, and set flags so this is skipped
@@ -529,7 +529,7 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
goto out;
}
- rc = rionet_setup_netdev(rdev->net->hport);
+ rc = rionet_setup_netdev(rdev->net->hport, ndev);
rionet_check = 1;
}
@@ -546,6 +546,8 @@ static int rionet_probe(struct rio_dev *rdev, const struct rio_device_id *id)
list_add_tail(&peer->node, &rionet_peers);
}
+ rio_set_drvdata(rdev, ndev);
+
out:
return rc;
}
--
1.7.0.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH]rionet: fix NULL pointer dereference in rionet_remove
2011-06-26 4:12 [PATCH]rionet: fix NULL pointer dereference in rionet_remove Yinglin Luan
@ 2011-06-29 12:57 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2011-06-29 12:57 UTC (permalink / raw)
To: synmyth; +Cc: netdev, mporter, jj, cmdkhh
From: Yinglin Luan <synmyth@gmail.com>
Date: Sun, 26 Jun 2011 12:12:12 +0800
> Function rionet_remove initializes local variable 'ndev' to NULL
> and do nothing changes before the call to unregister_netdev(ndev),
> this could cause a NULL pointer dereference.
>
> Reported-by: Jesper Juhl <jj@chaosbits.net>
> Signed-off-by: Yinglin Luan <synmyth@gmail.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH]rionet: fix NULL pointer dereference in rionet_remove
2011-06-18 15:27 Yinglin Luan
@ 2011-06-20 5:44 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2011-06-20 5:44 UTC (permalink / raw)
To: synmyth; +Cc: netdev, mporter, jj, cmdkhh
From: Yinglin Luan <synmyth@gmail.com>
Date: Sat, 18 Jun 2011 23:27:15 +0800
> -static int rionet_setup_netdev(struct rio_mport *mport)
> +static int rionet_setup_netdev(struct rio_mport *mport, struct
> net_device *ndev)
This patch has been mangled by your email client.
Read Documentation/email-clients.txt
Send a test patch to yourself, make sure it applies for you.
Then resend your patch here.
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH]rionet: fix NULL pointer dereference in rionet_remove
@ 2011-06-18 15:27 Yinglin Luan
2011-06-20 5:44 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: Yinglin Luan @ 2011-06-18 15:27 UTC (permalink / raw)
To: netdev; +Cc: davem, mporter, jj, cmdkhh, synmyth
Function rionet_remove initializes local variable 'ndev' to NULL
and do nothing changes before the call to unregister_netdev(ndev),
this could cause a NULL pointer dereference.
Reported-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Yinglin Luan <synmyth@gmail.com>
---
drivers/net/rionet.c | 28 +++++++++++++++-------------
1 files changed, 15 insertions(+), 13 deletions(-)
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 77c5092..5d3436d 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -378,7 +378,7 @@ static int rionet_close(struct net_device *ndev)
static void rionet_remove(struct rio_dev *rdev)
{
- struct net_device *ndev = NULL;
+ struct net_device *ndev = rio_get_drvdata(rdev);
struct rionet_peer *peer, *tmp;
free_pages((unsigned long)rionet_active, rdev->net->hport->sys_size ?
@@ -433,22 +433,12 @@ static const struct net_device_ops
rionet_netdev_ops = {
.ndo_set_mac_address = eth_mac_addr,
};
-static int rionet_setup_netdev(struct rio_mport *mport)
+static int rionet_setup_netdev(struct rio_mport *mport, struct
net_device *ndev)
{
int rc = 0;
- struct net_device *ndev = NULL;
struct rionet_private *rnet;
u16 device_id;
- /* Allocate our net_device structure */
- ndev = alloc_etherdev(sizeof(struct rionet_private));
- if (ndev == NULL) {
- printk(KERN_INFO "%s: could not allocate ethernet device.\n",
- DRV_NAME);
- rc = -ENOMEM;
- goto out;
- }
-
rionet_active = (struct rio_dev **)__get_free_pages(GFP_KERNEL,
mport->sys_size ? __fls(sizeof(void *)) + 4 : 0);
if (!rionet_active) {
@@ -504,11 +494,21 @@ static int rionet_probe(struct rio_dev *rdev,
const struct rio_device_id *id)
int rc = -ENODEV;
u32 lpef, lsrc_ops, ldst_ops;
struct rionet_peer *peer;
+ struct net_device *ndev = NULL;
/* If local device is not rionet capable, give up quickly */
if (!rionet_capable)
goto out;
+ /* Allocate our net_device structure */
+ ndev = alloc_etherdev(sizeof(struct rionet_private));
+ if (ndev == NULL) {
+ printk(KERN_INFO "%s: could not allocate ethernet device.\n",
+ DRV_NAME);
+ rc = -ENOMEM;
+ goto out;
+ }
+
/*
* First time through, make sure local device is rionet
* capable, setup netdev, and set flags so this is skipped
@@ -529,7 +529,7 @@ static int rionet_probe(struct rio_dev *rdev, const
struct rio_device_id *id)
goto out;
}
- rc = rionet_setup_netdev(rdev->net->hport);
+ rc = rionet_setup_netdev(rdev->net->hport, ndev);
rionet_check = 1;
}
@@ -546,6 +546,8 @@ static int rionet_probe(struct rio_dev *rdev, const
struct rio_device_id *id)
list_add_tail(&peer->node, &rionet_peers);
}
+ rio_set_drvdata(rdev, ndev);
+
out:
return rc;
}
--
1.7.5.4
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2011-06-29 12:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-06-26 4:12 [PATCH]rionet: fix NULL pointer dereference in rionet_remove Yinglin Luan
2011-06-29 12:57 ` David Miller
-- strict thread matches above, loose matches on Subject: below --
2011-06-18 15:27 Yinglin Luan
2011-06-20 5:44 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.