| Message ID | 20180316104754.29768-2-po-hsu.lin@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | [X/A/B,SRU,1/1] net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe() | expand |
On 2018-03-16 18:47:54 , Po-Hsu Lin wrote: > From: Wei Yongjun <weiyongjun1@huawei.com> > > CVE-2018-8043 > > platform_get_resource() may fail and return NULL, so we should > better check it's return value to avoid a NULL pointer dereference > a bit later in the code. > > This is detected by Coccinelle semantic patch. > > @@ > expression pdev, res, n, t, e, e1, e2; > @@ > > res = platform_get_resource(pdev, t, n); > + if (!res) > + return -EINVAL; > ... when != res == NULL > e = devm_ioremap(e1, res->start, e2); > > Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> > Signed-off-by: David S. Miller <davem@davemloft.net> > (cherry picked from commit 297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5) > Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> > --- > drivers/net/phy/mdio-bcm-unimac.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c > index 4bde5e7..fd8692b 100644 > --- a/drivers/net/phy/mdio-bcm-unimac.c > +++ b/drivers/net/phy/mdio-bcm-unimac.c > @@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev) > return -ENOMEM; > > r = platform_get_resource(pdev, IORESOURCE_MEM, 0); > + if (!r) > + return -EINVAL; > > /* Just ioremap, as this MDIO block is usually integrated into an > * Ethernet MAC controller register range Acked-by: Khalid Elmously <khalid.elmously@canonical.com>
On 16.03.2018 11:47, Po-Hsu Lin wrote: > From: Wei Yongjun <weiyongjun1@huawei.com> > > CVE-2018-8043 > > platform_get_resource() may fail and return NULL, so we should > better check it's return value to avoid a NULL pointer dereference > a bit later in the code. > > This is detected by Coccinelle semantic patch. > > @@ > expression pdev, res, n, t, e, e1, e2; > @@ > > res = platform_get_resource(pdev, t, n); > + if (!res) > + return -EINVAL; > ... when != res == NULL > e = devm_ioremap(e1, res->start, e2); > > Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> > Signed-off-by: David S. Miller <davem@davemloft.net> > (cherry picked from commit 297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5) > Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com> > --- > drivers/net/phy/mdio-bcm-unimac.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c > index 4bde5e7..fd8692b 100644 > --- a/drivers/net/phy/mdio-bcm-unimac.c > +++ b/drivers/net/phy/mdio-bcm-unimac.c > @@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev) > return -ENOMEM; > > r = platform_get_resource(pdev, IORESOURCE_MEM, 0); > + if (!r) > + return -EINVAL; > > /* Just ioremap, as this MDIO block is usually integrated into an > * Ethernet MAC controller register range > Applied to xenial and artful master-next
diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c index 4bde5e7..fd8692b 100644 --- a/drivers/net/phy/mdio-bcm-unimac.c +++ b/drivers/net/phy/mdio-bcm-unimac.c @@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev) return -ENOMEM; r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!r) + return -EINVAL; /* Just ioremap, as this MDIO block is usually integrated into an * Ethernet MAC controller register range