LinuxLists.cc - [PATCH net v2] net: mvpp2: fix possible invalid pointer dereference

2022-11-15 09:18:43

Subject: [PATCH net v2] net: mvpp2: fix possible invalid pointer dereference

2022-11-15 09:24:49

Subject: Re: [PATCH net v2] net: mvpp2: fix possible invalid pointer dereference

wt., 15 lis 2022 o 10:08 Hui Tang <[email protected]> napisał(a):
>
> It will cause invalid pointer dereference to priv->cm3_base behind,
> if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().
>
> Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
> Signed-off-by: Hui Tang <[email protected]>
> ---
> v1 -> v2: patch title include target
> ---
> drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> index d98f7e9a480e..c92bd1922421 100644
> --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> @@ -7421,7 +7421,7 @@ static int mvpp2_probe(struct platform_device *pdev)
> dev_warn(&pdev->dev, "Fail to alloc CM3 SRAM\n");
>
> /* Enable global Flow Control only if handler to SRAM not NULL */
> - if (priv->cm3_base)
> + if (!IS_ERR_OR_NULL(priv->cm3_base))
> priv->global_tx_fc = true;
> }
>
> --
> 2.17.1
>

Thank you for the patch.

Reviewed-by: Marcin Wojtas <[email protected]>

Best regards,
Marcin

2022-11-15 16:44:52

by Andrew Lunn

[permalink] [raw]

Subject: Re: [PATCH net v2] net: mvpp2: fix possible invalid pointer dereference

On Tue, Nov 15, 2022 at 05:04:33PM +0800, Hui Tang wrote:
> It will cause invalid pointer dereference to priv->cm3_base behind,
> if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().

As i pointed out for the MDIO driver, i wonder if this is the correct
fix. mvpp2_get_sram() is probably a better place to handle this

In fact, please add a devm_ioremap_resource_optional() which returns
NULL if the resource does not exist, or an error code for real errors,
and make drivers fail the probe on real errors.

Andrew

2022-11-16 02:18:02

by Hui Tang

[permalink] [raw]

Subject: [PATCH net v3] net: mvpp2: fix possible invalid pointer dereference

It will cause invalid pointer dereference to priv->cm3_base behind,
if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().

Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
Signed-off-by: Hui Tang <[email protected]>
---
v1 -> v2: patch title include target
v2 -> v3: keep priv->cm3_base NULL if devm_ioremap_resource() failed
---
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index d98f7e9a480e..9c3fbb153b5b 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev,
struct mvpp2 *priv)
{
struct resource *res;
+ void __iomem *base;

res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
if (!res) {
@@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev,
return 0;
}

- priv->cm3_base = devm_ioremap_resource(&pdev->dev, res);
+ base = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(priv->cm3_base))
+ priv->cm3_base = base;

- return PTR_ERR_OR_ZERO(priv->cm3_base);
+ return PTR_ERR_OR_ZERO(base);
}

static int mvpp2_probe(struct platform_device *pdev)
--
2.17.1

2022-11-16 02:36:22

by Hui Tang

[permalink] [raw]

Subject: [PATCH net v4] net: mvpp2: fix possible invalid pointer dereference

It will cause invalid pointer dereference to priv->cm3_base behind,
if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().

Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
Signed-off-by: Hui Tang <[email protected]>
---
v1 -> v2: patch title include target
v2 -> v3: keep priv->cm3_base NULL if devm_ioremap_resource() failed
v3 -> v4: change if (priv->cm3_base) to if (base)
---
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index d98f7e9a480e..efb582b63640 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev,
struct mvpp2 *priv)
{
struct resource *res;
+ void __iomem *base;

res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
if (!res) {
@@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev,
return 0;
}

- priv->cm3_base = devm_ioremap_resource(&pdev->dev, res);
+ base = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(base))
+ priv->cm3_base = base;

- return PTR_ERR_OR_ZERO(priv->cm3_base);
+ return PTR_ERR_OR_ZERO(base);
}

static int mvpp2_probe(struct platform_device *pdev)
--
2.17.1

2022-11-16 04:40:11

by Jakub Kicinski

[permalink] [raw]

Subject: Re: [PATCH net v4] net: mvpp2: fix possible invalid pointer dereference

On Wed, 16 Nov 2022 10:14:37 +0800 Hui Tang wrote:
> It will cause invalid pointer dereference to priv->cm3_base behind,
> if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().
>
> Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
> Signed-off-by: Hui Tang <[email protected]>

Please do not repost new versions so often:

https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr

do not use --in-reply-to

> diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> index d98f7e9a480e..efb582b63640 100644
> --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
> @@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev,
> struct mvpp2 *priv)
> {
> struct resource *res;
> + void __iomem *base;
>
> res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
> if (!res) {
> @@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev,
> return 0;
> }
>
> - priv->cm3_base = devm_ioremap_resource(&pdev->dev, res);
> + base = devm_ioremap_resource(&pdev->dev, res);
> + if (!IS_ERR(base))
> + priv->cm3_base = base;
>
> - return PTR_ERR_OR_ZERO(priv->cm3_base);
> + return PTR_ERR_OR_ZERO(base);

Use the idiomatic error handling, keep success path un-indented:

ptr = function();
if (IS_ERR(ptr))
return PTR_ERR(ptr);

priv->bla = ptr;
return 0;

2022-11-16 06:53:55

by Hui Tang

[permalink] [raw]

Subject: Re: [PATCH net v4] net: mvpp2: fix possible invalid pointer dereference

On 2022/11/16 12:28, Jakub Kicinski wrote:
> On Wed, 16 Nov 2022 10:14:37 +0800 Hui Tang wrote:
>> It will cause invalid pointer dereference to priv->cm3_base behind,
>> if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().
>>
>> Fixes: a59d354208a7 ("net: mvpp2: enable global flow control")
>> Signed-off-by: Hui Tang <[email protected]>
>
> Please do not repost new versions so often:
>
> https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#tl-dr
>
> do not use --in-reply-to

Thanks for pointing out, but should I resend it with [PATCH net v3] or [PATCH net v5]?

>> diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
>> index d98f7e9a480e..efb582b63640 100644
>> --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
>> +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
>> @@ -7349,6 +7349,7 @@ static int mvpp2_get_sram(struct platform_device *pdev,
>> struct mvpp2 *priv)
>> {
>> struct resource *res;
>> + void __iomem *base;
>>
>> res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
>> if (!res) {
>> @@ -7359,9 +7360,11 @@ static int mvpp2_get_sram(struct platform_device *pdev,
>> return 0;
>> }
>>
>> - priv->cm3_base = devm_ioremap_resource(&pdev->dev, res);
>> + base = devm_ioremap_resource(&pdev->dev, res);
>> + if (!IS_ERR(base))
>> + priv->cm3_base = base;
>>
>> - return PTR_ERR_OR_ZERO(priv->cm3_base);
>> + return PTR_ERR_OR_ZERO(base);
>
> Use the idiomatic error handling, keep success path un-indented:
>
> ptr = function();
> if (IS_ERR(ptr))
> return PTR_ERR(ptr);
>
> priv->bla = ptr;
> return 0;
>
>
Ok, I will fix it in next version

2022-11-16 13:45:25

by Andrew Lunn

[permalink] [raw]

Subject: Re: [PATCH net v4] net: mvpp2: fix possible invalid pointer dereference

> Thanks for pointing out, but should I resend it with [PATCH net v3]
> or [PATCH net v5]?

The number should always increment. It is how we tell older versions
from newer versions.

Andrew