All of lore.kernel.org
 help / color / mirror / Atom feed
From: Florian Fainelli <florian.fainelli@broadcom.com>
To: netdev@vger.kernel.org
Cc: Florian Fainelli <florian.fainelli@broadcom.com>,
	Nicolai Buchwitz <nb@tipi-net.de>,
	Doug Berger <opendmb@gmail.com>,
	Broadcom internal kernel review list
	<bcm-kernel-feedback-list@broadcom.com>,
	Andrew Lunn <andrew+netdev@lunn.ch>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Zak Kemble <zakkemble@gmail.com>, Simon Horman <horms@kernel.org>,
	Ryo Takakura <ryotkkr98@gmail.com>,
	linux-kernel@vger.kernel.org (open list)
Subject: [PATCH net v2 03/10] net: systemport: Fix NULL pointer dereference in bcm_sysport_fini_rx_ring()
Date: Tue, 22 Sep 2026 16:24:33 -0700	[thread overview]
Message-ID: <20260922232440.598918-4-florian.fainelli@broadcom.com> (raw)
In-Reply-To: <20260922232440.598918-1-florian.fainelli@broadcom.com>

If allocation of priv->rx_cbs fails during bcm_sysport_init_rx_ring(),
error unwinding in bcm_sysport_open() calls bcm_sysport_fini_rx_ring().
Without checking if priv->rx_cbs is non-NULL, bcm_sysport_fini_rx_ring()
dereferences priv->rx_cbs, resulting in a NULL pointer dereference.

Add a check for !priv->rx_cbs at the beginning of
bcm_sysport_fini_rx_ring(), matching bcm_sysport_fini_tx_ring().

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Assisted-by: LLM
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 8328fe824d15..b91a57540f55 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1717,6 +1717,9 @@ static void bcm_sysport_fini_rx_ring(struct bcm_sysport_priv *priv)
 	if (!(reg & RDMA_DISABLED))
 		netdev_warn(priv->netdev, "RDMA not stopped!\n");
 
+	if (!priv->rx_cbs)
+		return;
+
 	for (i = 0; i < priv->num_rx_bds; i++) {
 		cb = &priv->rx_cbs[i];
 		if (dma_unmap_addr(cb, dma_addr))
-- 
2.34.1


  parent reply	other threads:[~2026-09-22 23:24 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-22 23:24 [PATCH net v2 00/10] net: systemport: Collection of fixes Florian Fainelli
2026-09-22 23:24 ` [PATCH net v2 01/10] net: systemport: Fix buffer overflow in bcm_sysport_get_stats() Florian Fainelli
2026-09-29  0:00   ` Jakub Kicinski
2026-09-22 23:24 ` [PATCH net v2 02/10] net: systemport: Fix invalid dev_id argument in bcm_sysport_poll_controller() Florian Fainelli
2026-09-24  2:21   ` netdev-bot+sashiko
2026-09-29  0:00   ` Jakub Kicinski
2026-09-22 23:24 ` Florian Fainelli [this message]
2026-09-22 23:24 ` [PATCH net v2 04/10] net: systemport: Fix Wake-on-LAN RXCHK filter enable loop Florian Fainelli
2026-09-22 23:24 ` [PATCH net v2 05/10] net: systemport: Fix RUNT MIB counter register offset calculation Florian Fainelli
2026-09-24  2:21   ` netdev-bot+sashiko
2026-09-22 23:24 ` [PATCH net v2 06/10] net: systemport: Fix potential packet length underflow in bcm_sysport_desc_rx() Florian Fainelli
2026-09-24  2:21   ` netdev-bot+sashiko
2026-09-29  0:03   ` Jakub Kicinski
2026-09-22 23:24 ` [PATCH net v2 07/10] net: systemport: Fix out-of-bounds array accesses in DSA queue mapping Florian Fainelli
2026-09-24  2:21   ` netdev-bot+sashiko
2026-09-29  0:05   ` Jakub Kicinski
2026-09-22 23:24 ` [PATCH net v2 08/10] net: systemport: Fix inverted error messages in bcm_sysport_stop() Florian Fainelli
2026-09-22 23:24 ` [PATCH net v2 09/10] net: systemport: Fix unbalanced Wake-on-LAN clock disable in resume Florian Fainelli
2026-09-24  2:21   ` netdev-bot+sashiko
2026-09-22 23:24 ` [PATCH net v2 10/10] net: systemport: Update TDMA queue mapping dynamically on changeupper Florian Fainelli
2026-09-24  2:21   ` netdev-bot+sashiko
2026-09-23  0:11 ` [PATCH net v2 00/10] net: systemport: Collection of fixes Jakub Kicinski
2026-09-29  0:08 ` Jakub Kicinski
2026-09-29  0:10 ` patchwork-bot+netdevbpf
2026-09-29  0:10 ` patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260922232440.598918-4-florian.fainelli@broadcom.com \
    --to=florian.fainelli@broadcom.com \
    --cc=andrew+netdev@lunn.ch \
    --cc=bcm-kernel-feedback-list@broadcom.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nb@tipi-net.de \
    --cc=netdev@vger.kernel.org \
    --cc=opendmb@gmail.com \
    --cc=pabeni@redhat.com \
    --cc=ryotkkr98@gmail.com \
    --cc=zakkemble@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.