Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754231AbcJIKKU (ORCPT ); Sun, 9 Oct 2016 06:10:20 -0400 Received: from einhorn.in-berlin.de ([192.109.42.8]:35892 "EHLO einhorn.in-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752247AbcJIKKT (ORCPT ); Sun, 9 Oct 2016 06:10:19 -0400 X-Envelope-From: stefanr@s5r6.in-berlin.de Date: Sun, 9 Oct 2016 11:51:05 +0200 From: Stefan Richter To: Alexey Khoroshilov Cc: linux1394-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: Re: [PATCH] firewire: nosy: do not ignore errors in ioremap_nocache() Message-ID: <20161009115105.30640740@kant> In-Reply-To: <1474751945-25757-1-git-send-email-khoroshilov@ispras.ru> References: <1474751945-25757-1-git-send-email-khoroshilov@ispras.ru> X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.31; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2916 Lines: 92 On Sep 25 Alexey Khoroshilov wrote: > There is no check if ioremap_nocache() returns a valid pointer. > Potentially it can lead to null pointer dereference. > > Found by Linux Driver Verification project (linuxtesting.org). > > Signed-off-by: Alexey Khoroshilov > --- > drivers/firewire/nosy.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c > index 631c977b0da5..f68a749f740b 100644 > --- a/drivers/firewire/nosy.c > +++ b/drivers/firewire/nosy.c > @@ -566,6 +566,11 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) > > lynx->registers = ioremap_nocache(pci_resource_start(dev, 0), > PCILYNX_MAX_REGISTER); > + if (lynx->registers == NULL) { > + dev_err(&dev->dev, "Failed to map registers\n"); > + ret = -ENOMEM; > + goto fail_deallocate2; > + } > > lynx->rcv_start_pcl = pci_alloc_consistent(lynx->pci_device, > sizeof(struct pcl), &lynx->rcv_start_pcl_bus); > @@ -679,6 +684,8 @@ fail_deallocate: > pci_free_consistent(lynx->pci_device, PAGE_SIZE, > lynx->rcv_buffer, lynx->rcv_buffer_bus); > iounmap(lynx->registers); > + > +fail_deallocate2: > kfree(lynx); > > fail_disable: Thanks. Committed to linux1394.git. I folded the following cosmetic change into the commit: --- a/drivers/firewire/nosy.c +++ b/drivers/firewire/nosy.c @@ -569,7 +569,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) if (lynx->registers == NULL) { dev_err(&dev->dev, "Failed to map registers\n"); ret = -ENOMEM; - goto fail_deallocate2; + goto fail_deallocate_lynx; } lynx->rcv_start_pcl = pci_alloc_consistent(lynx->pci_device, @@ -583,7 +583,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) lynx->rcv_buffer == NULL) { dev_err(&dev->dev, "Failed to allocate receive buffer\n"); ret = -ENOMEM; - goto fail_deallocate; + goto fail_deallocate_buffers; } lynx->rcv_start_pcl->next = cpu_to_le32(lynx->rcv_pcl_bus); lynx->rcv_pcl->next = cpu_to_le32(PCL_NEXT_INVALID); @@ -646,7 +646,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) dev_err(&dev->dev, "Failed to allocate shared interrupt %d\n", dev->irq); ret = -EIO; - goto fail_deallocate; + goto fail_deallocate_buffers; } lynx->misc.parent = &dev->dev; @@ -673,7 +673,7 @@ fail_free_irq: reg_write(lynx, PCI_INT_ENABLE, 0); free_irq(lynx->pci_device->irq, lynx); -fail_deallocate: +fail_deallocate_buffers: if (lynx->rcv_start_pcl) pci_free_consistent(lynx->pci_device, sizeof(struct pcl), lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus); @@ -685,7 +685,7 @@ fail_deallocate: lynx->rcv_buffer, lynx->rcv_buffer_bus); iounmap(lynx->registers); -fail_deallocate2: +fail_deallocate_lynx: kfree(lynx); fail_disable: -- Stefan Richter -======----- =-=- -=--= http://arcgraph.de/sr/