lkml.org 
[lkml]   [2018]   [Jun]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH net-next] net: fddi: fix a possible null-ptr-deref
From
Date
On 2018/6/5 18:06, YueHaibing wrote:
> bp->SharedMemAddr is set to NULL while bp->SharedMemSize less than 0,
> then memset will trigger null-ptr-deref.
>
> Fix it use pci_zalloc_consistent when bp->SharedMemSize is greater than 0.
>
> Signed-off-by: YueHaibing <yuehaibing@huawei.com>
> ---
> drivers/net/fddi/skfp/skfddi.c | 10 ++++------
> 1 file changed, 4 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/fddi/skfp/skfddi.c b/drivers/net/fddi/skfp/skfddi.c
> index 2414f1d..90164e0 100644
> --- a/drivers/net/fddi/skfp/skfddi.c
> +++ b/drivers/net/fddi/skfp/skfddi.c
> @@ -407,23 +407,21 @@ static int skfp_driver_init(struct net_device *dev)
> if (bp->SharedMemSize > 0) {
> bp->SharedMemSize += 16; // for descriptor alignment
>
> - bp->SharedMemAddr = pci_alloc_consistent(&bp->pdev,
> - bp->SharedMemSize,
> - &bp->SharedMemDMA);
> + bp->SharedMemAddr = pci_zalloc_consistent(&bp->pdev,
> + bp->SharedMemSize,
> + &bp->SharedMemDMA);

This also need move from pci_dma* to dma_*, will send v2

> if (!bp->SharedMemAddr) {
> printk("could not allocate mem for ");
> printk("hardware module: %ld byte\n",
> bp->SharedMemSize);
> goto fail;
> }
> - bp->SharedMemHeap = 0; // Nothing used yet.
>
> } else {
> bp->SharedMemAddr = NULL;
> - bp->SharedMemHeap = 0;
> } // SharedMemSize > 0
>
> - memset(bp->SharedMemAddr, 0, bp->SharedMemSize);
> + bp->SharedMemHeap = 0;
>
> card_stop(smc); // Reset adapter.
>
>

\
 
 \ /
  Last update: 2018-06-05 15:08    [W:0.021 / U:37.628 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site