* [PATCH net-next] net: fddi: fix a possible null-ptr-deref
@ 2018-06-05 10:06 YueHaibing
2018-06-05 13:08 ` YueHaibing
0 siblings, 1 reply; 2+ messages in thread
From: YueHaibing @ 2018-06-05 10:06 UTC (permalink / raw)
To: davem; +Cc: netdev, linux-kernel, YueHaibing
bp->SharedMemAddr is set to NULL while bp->SharedMemSize less than 0,
then memset will trigger null-ptr-deref.
Fix it use pci_zalloc_consistent when bp->SharedMemSize is greater than 0.
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
---
drivers/net/fddi/skfp/skfddi.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/net/fddi/skfp/skfddi.c b/drivers/net/fddi/skfp/skfddi.c
index 2414f1d..90164e0 100644
--- a/drivers/net/fddi/skfp/skfddi.c
+++ b/drivers/net/fddi/skfp/skfddi.c
@@ -407,23 +407,21 @@ static int skfp_driver_init(struct net_device *dev)
if (bp->SharedMemSize > 0) {
bp->SharedMemSize += 16; // for descriptor alignment
- bp->SharedMemAddr = pci_alloc_consistent(&bp->pdev,
- bp->SharedMemSize,
- &bp->SharedMemDMA);
+ bp->SharedMemAddr = pci_zalloc_consistent(&bp->pdev,
+ bp->SharedMemSize,
+ &bp->SharedMemDMA);
if (!bp->SharedMemAddr) {
printk("could not allocate mem for ");
printk("hardware module: %ld byte\n",
bp->SharedMemSize);
goto fail;
}
- bp->SharedMemHeap = 0; // Nothing used yet.
} else {
bp->SharedMemAddr = NULL;
- bp->SharedMemHeap = 0;
} // SharedMemSize > 0
- memset(bp->SharedMemAddr, 0, bp->SharedMemSize);
+ bp->SharedMemHeap = 0;
card_stop(smc); // Reset adapter.
--
2.7.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] net: fddi: fix a possible null-ptr-deref
2018-06-05 10:06 [PATCH net-next] net: fddi: fix a possible null-ptr-deref YueHaibing
@ 2018-06-05 13:08 ` YueHaibing
0 siblings, 0 replies; 2+ messages in thread
From: YueHaibing @ 2018-06-05 13:08 UTC (permalink / raw)
To: davem; +Cc: netdev, linux-kernel
On 2018/6/5 18:06, YueHaibing wrote:
> bp->SharedMemAddr is set to NULL while bp->SharedMemSize less than 0,
> then memset will trigger null-ptr-deref.
>
> Fix it use pci_zalloc_consistent when bp->SharedMemSize is greater than 0.
>
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
> ---
> drivers/net/fddi/skfp/skfddi.c | 10 ++++------
> 1 file changed, 4 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/fddi/skfp/skfddi.c b/drivers/net/fddi/skfp/skfddi.c
> index 2414f1d..90164e0 100644
> --- a/drivers/net/fddi/skfp/skfddi.c
> +++ b/drivers/net/fddi/skfp/skfddi.c
> @@ -407,23 +407,21 @@ static int skfp_driver_init(struct net_device *dev)
> if (bp->SharedMemSize > 0) {
> bp->SharedMemSize += 16; // for descriptor alignment
>
> - bp->SharedMemAddr = pci_alloc_consistent(&bp->pdev,
> - bp->SharedMemSize,
> - &bp->SharedMemDMA);
> + bp->SharedMemAddr = pci_zalloc_consistent(&bp->pdev,
> + bp->SharedMemSize,
> + &bp->SharedMemDMA);
This also need move from pci_dma* to dma_*, will send v2
> if (!bp->SharedMemAddr) {
> printk("could not allocate mem for ");
> printk("hardware module: %ld byte\n",
> bp->SharedMemSize);
> goto fail;
> }
> - bp->SharedMemHeap = 0; // Nothing used yet.
>
> } else {
> bp->SharedMemAddr = NULL;
> - bp->SharedMemHeap = 0;
> } // SharedMemSize > 0
>
> - memset(bp->SharedMemAddr, 0, bp->SharedMemSize);
> + bp->SharedMemHeap = 0;
>
> card_stop(smc); // Reset adapter.
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-06-05 13:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-06-05 10:06 [PATCH net-next] net: fddi: fix a possible null-ptr-deref YueHaibing
2018-06-05 13:08 ` YueHaibing
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).