netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Aditya Pakki <pakki001@umn.edu>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	linux-atm-general@lists.sourceforge.net, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 074/186] fore200e: Fix incorrect checks of NULL pointer dereference
Date: Fri, 14 Feb 2020 11:15:23 -0500	[thread overview]
Message-ID: <20200214161715.18113-74-sashal@kernel.org> (raw)
In-Reply-To: <20200214161715.18113-1-sashal@kernel.org>

From: Aditya Pakki <pakki001@umn.edu>

[ Upstream commit bbd20c939c8aa3f27fa30e86691af250bf92973a ]

In fore200e_send and fore200e_close, the pointers from the arguments
are dereferenced in the variable declaration block and then checked
for NULL. The patch fixes these issues by avoiding NULL pointer
dereferences.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/fore200e.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index f8b7e86907cc2..0a1ad1a1d34fb 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -1496,12 +1496,14 @@ fore200e_open(struct atm_vcc *vcc)
 static void
 fore200e_close(struct atm_vcc* vcc)
 {
-    struct fore200e*        fore200e = FORE200E_DEV(vcc->dev);
     struct fore200e_vcc*    fore200e_vcc;
+    struct fore200e*        fore200e;
     struct fore200e_vc_map* vc_map;
     unsigned long           flags;
 
     ASSERT(vcc);
+    fore200e = FORE200E_DEV(vcc->dev);
+
     ASSERT((vcc->vpi >= 0) && (vcc->vpi < 1<<FORE200E_VPI_BITS));
     ASSERT((vcc->vci >= 0) && (vcc->vci < 1<<FORE200E_VCI_BITS));
 
@@ -1546,10 +1548,10 @@ fore200e_close(struct atm_vcc* vcc)
 static int
 fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
-    struct fore200e*        fore200e     = FORE200E_DEV(vcc->dev);
-    struct fore200e_vcc*    fore200e_vcc = FORE200E_VCC(vcc);
+    struct fore200e*        fore200e;
+    struct fore200e_vcc*    fore200e_vcc;
     struct fore200e_vc_map* vc_map;
-    struct host_txq*        txq          = &fore200e->host_txq;
+    struct host_txq*        txq;
     struct host_txq_entry*  entry;
     struct tpd*             tpd;
     struct tpd_haddr        tpd_haddr;
@@ -1562,9 +1564,18 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
     unsigned char*          data;
     unsigned long           flags;
 
-    ASSERT(vcc);
-    ASSERT(fore200e);
-    ASSERT(fore200e_vcc);
+    if (!vcc)
+        return -EINVAL;
+
+    fore200e = FORE200E_DEV(vcc->dev);
+    fore200e_vcc = FORE200E_VCC(vcc);
+
+    if (!fore200e)
+        return -EINVAL;
+
+    txq = &fore200e->host_txq;
+    if (!fore200e_vcc)
+        return -EINVAL;
 
     if (!test_bit(ATM_VF_READY, &vcc->flags)) {
 	DPRINTK(1, "VC %d.%d.%d not ready for tx\n", vcc->itf, vcc->vpi, vcc->vpi);
-- 
2.20.1


  parent reply	other threads:[~2020-02-14 16:18 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20200214161715.18113-1-sashal@kernel.org>
2020-02-14 16:14 ` [PATCH AUTOSEL 4.14 008/186] brcmfmac: Fix use after free in brcmf_sdio_readframes() Sasha Levin
2020-02-14 16:14 ` [PATCH AUTOSEL 4.14 012/186] gianfar: Fix TX timestamping with a stacked DSA driver Sasha Levin
2020-02-14 16:14 ` [PATCH AUTOSEL 4.14 040/186] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held Sasha Levin
2020-02-14 16:14 ` [PATCH AUTOSEL 4.14 041/186] libertas: make lbs_ibss_join_existing() return error code on rates overflow Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 063/186] net/wan/fsl_ucc_hdlc: reject muram offsets above 64K Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 065/186] NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu() Sasha Levin
2020-02-14 16:15 ` Sasha Levin [this message]
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 075/186] isdn: don't mark kcapi_proc_exit as __exit Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 078/186] b43legacy: Fix -Wcast-function-type Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 079/186] ipw2x00: " Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 080/186] iwlegacy: " Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 081/186] rtlwifi: rtl_pci: " Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 083/186] orinoco: avoid assertion in case of NULL pointer Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 091/186] net/wan/fsl_ucc_hdlc: remove set but not used variables 'ut_info' and 'ret' Sasha Levin
2020-02-14 16:15 ` [PATCH AUTOSEL 4.14 100/186] tools lib api fs: Fix gcc9 stringop-truncation compilation error Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 116/186] wan: ixp4xx_hss: fix compile-testing on 64-bit Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 160/186] hostap: Adjust indentation in prism2_hostapd_add_sta Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 161/186] rtlwifi: rtl8821ae: remove unused variables Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 162/186] rtlwifi: rtl8192ee: " Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 163/186] rtlwifi: rtl8723ae: " Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 164/186] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 166/186] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() Sasha Levin
2020-02-14 16:16 ` [PATCH AUTOSEL 4.14 167/186] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() Sasha Levin
2020-02-14 16:17 ` [PATCH AUTOSEL 4.14 180/186] iwlwifi: mvm: Fix thermal zone registration Sasha Levin
2020-02-14 16:17 ` [PATCH AUTOSEL 4.14 186/186] mlxsw: spectrum_dpipe: Add missing error path Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200214161715.18113-74-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=davem@davemloft.net \
    --cc=linux-atm-general@lists.sourceforge.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pakki001@umn.edu \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).