2017-03-15 21:51:35

by Philippe Reynes

Subject: [PATCH v2] net: sun: sungem: rix a possible null dereference

The function gem_begin_auto_negotiation dereference
the pointer ep before testing if it's null. This
patch add a check on ep before dereferencing it.

Fixes: 92552fdd557 ("net: sun: sungem: use new api
ethtool_{get|set}_link_ksettings")

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Philippe Reynes <[email protected]>
---
Chanelog:
v2:
- use Fixes tag (thanks Sergei Shtylyov)

drivers/net/ethernet/sun/sungem.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index dbfca04..fa607d0 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -1259,8 +1259,9 @@ static void gem_begin_auto_negotiation(struct gem *gp,
int duplex;
u32 advertising;

- ethtool_convert_link_mode_to_legacy_u32(&advertising,
- ep->link_modes.advertising);
+ if (ep)
+ ethtool_convert_link_mode_to_legacy_u32(
+ &advertising, ep->link_modes.advertising);

if (gp->phy_type != phy_mii_mdio0 &&
gp->phy_type != phy_mii_mdio1)
--
1.7.4.4

2017-03-17 03:50:32

by David Miller

Subject: Re: [PATCH v2] net: sun: sungem: rix a possible null dereference

From: Philippe Reynes <[email protected]>
Date: Wed, 15 Mar 2017 22:51:13 +0100

> The function gem_begin_auto_negotiation dereference
> the pointer ep before testing if it's null. This
> patch add a check on ep before dereferencing it.
>
> Fixes: 92552fdd557 ("net: sun: sungem: use new api

[davem@localhost net-next]$ git describe 92552fdd557
fatal: Not a valid object name 92552fdd557
[davem@localhost net-next]$

I don't know where you got that SHA1-ID, but it's not the one that
was actually used.

It is advised that you use Linus's or one of my GIT trees to find the
proper commit IDs.