diff mbox series

[net,v4] net: mvpp2: fix possible invalid pointer dereference

Message ID 20221116021437.145204-1-tanghui20@huawei.com
State New
Headers
Series [net,v4] net: mvpp2: fix possible invalid pointer dereference |

Commit Message

Hui Tang Nov. 16, 2022, 2:14 a.m. UTC 
  It will cause invalid pointer dereference to priv->cm3_base behind,
if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().

Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
Signed-off-by: Hui Tang <tanghui20@huawei.com>
---
v1 -> v2: patch title include target
v2 -> v3: keep priv->cm3_base NULL if devm_ioremap_resource() failed
v3 -> v4: change if (priv->cm3_base) to if (base)
---
 drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Jakub Kicinski Nov. 16, 2022, 4:28 a.m. UTC | #1 
On Wed, 16 Nov 2022 10:14:37 +0800 Hui Tang wrote:
> It will cause invalid pointer dereference to priv->cm3_base behind,
> if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().
> 
> Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
> Signed-off-by: Hui Tang <tanghui20@huawei.com>

Please do not repost new versions so often:

https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr

do not use --in-reply-to

> diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> index d98f7e9a480e..efb582b63640 100644
> --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> @@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev,
>  			  struct mvpp2 *priv)
>  {
>  	struct resource *res;
> +	void __iomem *base;
>  
>  	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
>  	if (!res) {
> @@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev,
>  		return 0;
>  	}
>  
> -	priv->cm3_base = devm_ioremap_resource(&pdev->dev, res);
> +	base = devm_ioremap_resource(&pdev->dev, res);
> +	if (!IS_ERR(base))
> +		priv->cm3_base = base;
>  
> -	return PTR_ERR_OR_ZERO(priv->cm3_base);
> +	return PTR_ERR_OR_ZERO(base);

Use the idiomatic error handling, keep success path un-indented:

	ptr = function();
	if (IS_ERR(ptr))
		return PTR_ERR(ptr);

	priv->bla = ptr;
	return 0;
Hui Tang Nov. 16, 2022, 6:13 a.m. UTC | #2 
On 2022/11/16 12:28, Jakub Kicinski wrote:
> On Wed, 16 Nov 2022 10:14:37 +0800 Hui Tang wrote:
>> It will cause invalid pointer dereference to priv->cm3_base behind,
>> if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().
>>
>> Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
>> Signed-off-by: Hui Tang <tanghui20@huawei.com>
>
> Please do not repost new versions so often:
>
> https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr
>
> do not use --in-reply-to

Thanks for pointing out, but should I resend it with [PATCH net v3]  or [PATCH net v5]?

>> diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
>> index d98f7e9a480e..efb582b63640 100644
>> --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
>> +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
>> @@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev,
>>  			  struct mvpp2 *priv)
>>  {
>>  	struct resource *res;
>> +	void __iomem *base;
>>
>>  	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
>>  	if (!res) {
>> @@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev,
>>  		return 0;
>>  	}
>>
>> -	priv->cm3_base = devm_ioremap_resource(&pdev->dev, res);
>> +	base = devm_ioremap_resource(&pdev->dev, res);
>> +	if (!IS_ERR(base))
>> +		priv->cm3_base = base;
>>
>> -	return PTR_ERR_OR_ZERO(priv->cm3_base);
>> +	return PTR_ERR_OR_ZERO(base);
>
> Use the idiomatic error handling, keep success path un-indented:
>
> 	ptr = function();
> 	if (IS_ERR(ptr))
> 		return PTR_ERR(ptr);
>
> 	priv->bla = ptr;
> 	return 0;
> 	
>
Ok, I will fix it in next version
Andrew Lunn Nov. 16, 2022, 1:21 p.m. UTC | #3 
> Thanks for pointing out, but should I resend it with [PATCH net v3]
> or [PATCH net v5]?

The number should always increment. It is how we tell older versions
from newer versions.

     Andrew
diff mbox series

Patch

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index d98f7e9a480e..efb582b63640 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -7349,6 +7349,7 @@  static int mvpp2_get_sram(struct platform_device *pdev,
 			  struct mvpp2 *priv)
 {
 	struct resource *res;
+	void __iomem *base;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
 	if (!res) {
@@ -7359,9 +7360,11 @@  static int mvpp2_get_sram(struct platform_device *pdev,
 		return 0;
 	}
 
-	priv->cm3_base = devm_ioremap_resource(&pdev->dev, res);
+	base = devm_ioremap_resource(&pdev->dev, res);
+	if (!IS_ERR(base))
+		priv->cm3_base = base;
 
-	return PTR_ERR_OR_ZERO(priv->cm3_base);
+	return PTR_ERR_OR_ZERO(base);
 }
 
 static int mvpp2_probe(struct platform_device *pdev)