2020-12-08 01:54:29

by Zhang Changzhong

Subject: [PATCH net] net: ll_temac: Fix potential NULL dereference in temac_probe()

platform_get_resource() may fail and in this case a NULL dereference
will occur.

Fix it to use devm_platform_ioremap_resource() instead of calling
platform_get_resource() and devm_ioremap().

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t, n);
+ if (!res)
+ return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Fixes: 8425c41d1ef7 ("net: ll_temac: Extend support to non-device-tree platforms")
Signed-off-by: Zhang Changzhong <[email protected]>
---
drivers/net/ethernet/xilinx/ll_temac_main.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
index 60c199f..0301853 100644
--- a/drivers/net/ethernet/xilinx/ll_temac_main.c
+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
@@ -1351,7 +1351,6 @@ static int temac_probe(struct platform_device *pdev)
struct device_node *temac_np = dev_of_node(&pdev->dev), *dma_np;
struct temac_local *lp;
struct net_device *ndev;
- struct resource *res;
const void *addr;
__be32 *p;
bool little_endian;
@@ -1500,13 +1499,11 @@ static int temac_probe(struct platform_device *pdev)
of_node_put(dma_np);
} else if (pdata) {
/* 2nd memory resource specifies DMA registers */
- res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
- lp->sdma_regs = devm_ioremap(&pdev->dev, res->start,
- resource_size(res));
- if (!lp->sdma_regs) {
+ lp->sdma_regs = devm_platform_ioremap_resource(pdev, 1);
+ if (IS_ERR(lp->sdma_regs)) {
dev_err(&pdev->dev,
"could not map DMA registers\n");
- return -ENOMEM;
+ return PTR_ERR(lp->sdma_regs);
}
if (pdata->dma_little_endian) {
lp->dma_in = temac_dma_in32_le;
--
2.9.5

2020-12-08 08:36:33

by Esben Haabendal

Subject: Re: [PATCH net] net: ll_temac: Fix potential NULL dereference in temac_probe()

Zhang Changzhong <[email protected]> writes:

> platform_get_resource() may fail and in this case a NULL dereference
> will occur.
>
> Fix it to use devm_platform_ioremap_resource() instead of calling
> platform_get_resource() and devm_ioremap().
>
> This is detected by Coccinelle semantic patch.
>
> @@
> expression pdev, res, n, t, e, e1, e2;
> @@
>
> res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t, n);
> + if (!res)
> + return -EINVAL;
> ... when != res == NULL
> e = devm_ioremap(e1, res->start, e2);
>
> Fixes: 8425c41d1ef7 ("net: ll_temac: Extend support to non-device-tree platforms")
> Signed-off-by: Zhang Changzhong <[email protected]>
> ---
> drivers/net/ethernet/xilinx/ll_temac_main.c | 9 +++------
> 1 file changed, 3 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c
> index 60c199f..0301853 100644
> --- a/drivers/net/ethernet/xilinx/ll_temac_main.c
> +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c
> @@ -1351,7 +1351,6 @@ static int temac_probe(struct platform_device *pdev)
> struct device_node *temac_np = dev_of_node(&pdev->dev), *dma_np;
> struct temac_local *lp;
> struct net_device *ndev;
> - struct resource *res;
> const void *addr;
> __be32 *p;
> bool little_endian;
> @@ -1500,13 +1499,11 @@ static int temac_probe(struct platform_device *pdev)
> of_node_put(dma_np);
> } else if (pdata) {
> /* 2nd memory resource specifies DMA registers */
> - res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
> - lp->sdma_regs = devm_ioremap(&pdev->dev, res->start,
> - resource_size(res));
> - if (!lp->sdma_regs) {
> + lp->sdma_regs = devm_platform_ioremap_resource(pdev, 1);
> + if (IS_ERR(lp->sdma_regs)) {
> dev_err(&pdev->dev,
> "could not map DMA registers\n");
> - return -ENOMEM;
> + return PTR_ERR(lp->sdma_regs);
> }
> if (pdata->dma_little_endian) {
> lp->dma_in = temac_dma_in32_le;

Acked-by: Esben Haabendal <[email protected]>

2020-12-09 00:21:48

by David Miller

Subject: Re: [PATCH net] net: ll_temac: Fix potential NULL dereference in temac_probe()

From: Zhang Changzhong <[email protected]>
Date: Tue, 8 Dec 2020 09:53:42 +0800

> platform_get_resource() may fail and in this case a NULL dereference
> will occur.
>
> Fix it to use devm_platform_ioremap_resource() instead of calling
> platform_get_resource() and devm_ioremap().
>
> This is detected by Coccinelle semantic patch.
>
> @@
> expression pdev, res, n, t, e, e1, e2;
> @@
>
> res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t, n);
> + if (!res)
> + return -EINVAL;
> ... when != res == NULL
> e = devm_ioremap(e1, res->start, e2);
>
> Fixes: 8425c41d1ef7 ("net: ll_temac: Extend support to non-device-tree platforms")
> Signed-off-by: Zhang Changzhong <[email protected]>

Applied, thanks.