| Message ID | 20180605100627.16184-1-yuehaibing@huawei.com |
|---|---|
| State | Changes Requested, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net-next] net: fddi: fix a possible null-ptr-deref | expand |
On 2018/6/5 18:06, YueHaibing wrote: > bp->SharedMemAddr is set to NULL while bp->SharedMemSize less than 0, > then memset will trigger null-ptr-deref. > > Fix it use pci_zalloc_consistent when bp->SharedMemSize is greater than 0. > > Signed-off-by: YueHaibing <yuehaibing@huawei.com> > --- > drivers/net/fddi/skfp/skfddi.c | 10 ++++------ > 1 file changed, 4 insertions(+), 6 deletions(-) > > diff --git a/drivers/net/fddi/skfp/skfddi.c b/drivers/net/fddi/skfp/skfddi.c > index 2414f1d..90164e0 100644 > --- a/drivers/net/fddi/skfp/skfddi.c > +++ b/drivers/net/fddi/skfp/skfddi.c > @@ -407,23 +407,21 @@ static int skfp_driver_init(struct net_device *dev) > if (bp->SharedMemSize > 0) { > bp->SharedMemSize += 16; // for descriptor alignment > > - bp->SharedMemAddr = pci_alloc_consistent(&bp->pdev, > - bp->SharedMemSize, > - &bp->SharedMemDMA); > + bp->SharedMemAddr = pci_zalloc_consistent(&bp->pdev, > + bp->SharedMemSize, > + &bp->SharedMemDMA); This also need move from pci_dma* to dma_*, will send v2 > if (!bp->SharedMemAddr) { > printk("could not allocate mem for "); > printk("hardware module: %ld byte\n", > bp->SharedMemSize); > goto fail; > } > - bp->SharedMemHeap = 0; // Nothing used yet. > > } else { > bp->SharedMemAddr = NULL; > - bp->SharedMemHeap = 0; > } // SharedMemSize > 0 > > - memset(bp->SharedMemAddr, 0, bp->SharedMemSize); > + bp->SharedMemHeap = 0; > > card_stop(smc); // Reset adapter. > >
diff --git a/drivers/net/fddi/skfp/skfddi.c b/drivers/net/fddi/skfp/skfddi.c index 2414f1d..90164e0 100644 --- a/drivers/net/fddi/skfp/skfddi.c +++ b/drivers/net/fddi/skfp/skfddi.c @@ -407,23 +407,21 @@ static int skfp_driver_init(struct net_device *dev) if (bp->SharedMemSize > 0) { bp->SharedMemSize += 16; // for descriptor alignment - bp->SharedMemAddr = pci_alloc_consistent(&bp->pdev, - bp->SharedMemSize, - &bp->SharedMemDMA); + bp->SharedMemAddr = pci_zalloc_consistent(&bp->pdev, + bp->SharedMemSize, + &bp->SharedMemDMA); if (!bp->SharedMemAddr) { printk("could not allocate mem for "); printk("hardware module: %ld byte\n", bp->SharedMemSize); goto fail; } - bp->SharedMemHeap = 0; // Nothing used yet. } else { bp->SharedMemAddr = NULL; - bp->SharedMemHeap = 0; } // SharedMemSize > 0 - memset(bp->SharedMemAddr, 0, bp->SharedMemSize); + bp->SharedMemHeap = 0; card_stop(smc); // Reset adapter.
bp->SharedMemAddr is set to NULL while bp->SharedMemSize less than 0, then memset will trigger null-ptr-deref. Fix it use pci_zalloc_consistent when bp->SharedMemSize is greater than 0. Signed-off-by: YueHaibing <yuehaibing@huawei.com> --- drivers/net/fddi/skfp/skfddi.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)