* [PATCH] bios: fix a potential NULL deref in the PROM shadowing function
@ 2014-04-03 20:12 Martin Peres
[not found] ` <1396555961-2252-1-git-send-email-martin.peres-GANU6spQydw@public.gmane.org>
0 siblings, 1 reply; 4+ messages in thread
From: Martin Peres @ 2014-04-03 20:12 UTC (permalink / raw)
To: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW
Reported-by: Dan Carpenter <dan.carpenter-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
Signed-off-by: Martin Peres <martin.peres-GANU6spQydw@public.gmane.org>
---
nvkm/subdev/bios/base.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/nvkm/subdev/bios/base.c b/nvkm/subdev/bios/base.c
index 3de7d81..5f8643d 100644
--- a/nvkm/subdev/bios/base.c
+++ b/nvkm/subdev/bios/base.c
@@ -183,10 +183,11 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
goto out;
bios->data = kmalloc(bios->size, GFP_KERNEL);
- if (bios->data) {
- for (i = 0; i < bios->size; i += 4)
- ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
- }
+ if (!bios->data)
+ goto out;
+
+ for (i = 0; i < bios->size; i += 4)
+ ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
/* check the PCI record header */
pcir = nv_ro16(bios, 0x0018);
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] bios: fix a potential NULL deref in the PROM shadowing function
[not found] ` <1396555961-2252-1-git-send-email-martin.peres-GANU6spQydw@public.gmane.org>
@ 2014-05-27 9:15 ` Martin Peres
[not found] ` <538457CD.5080208-GANU6spQydw@public.gmane.org>
0 siblings, 1 reply; 4+ messages in thread
From: Martin Peres @ 2014-05-27 9:15 UTC (permalink / raw)
To: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW; +Cc: Ben Skeggs
Le 03/04/2014 22:12, Martin Peres a écrit :
> Reported-by: Dan Carpenter <dan.carpenter-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
> Signed-off-by: Martin Peres <martin.peres-GANU6spQydw@public.gmane.org>
> ---
> nvkm/subdev/bios/base.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/nvkm/subdev/bios/base.c b/nvkm/subdev/bios/base.c
> index 3de7d81..5f8643d 100644
> --- a/nvkm/subdev/bios/base.c
> +++ b/nvkm/subdev/bios/base.c
> @@ -183,10 +183,11 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
> goto out;
>
> bios->data = kmalloc(bios->size, GFP_KERNEL);
> - if (bios->data) {
> - for (i = 0; i < bios->size; i += 4)
> - ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
> - }
> + if (!bios->data)
> + goto out;
> +
> + for (i = 0; i < bios->size; i += 4)
> + ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
>
> /* check the PCI record header */
> pcir = nv_ro16(bios, 0x0018);
>
This patch never got reviewed or pushed. It should also be sent as a fix
for the next 3.15 rc, if possible.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] bios: fix a potential NULL deref in the PROM shadowing function
[not found] ` <538457CD.5080208-GANU6spQydw@public.gmane.org>
@ 2014-05-29 23:39 ` Ben Skeggs
[not found] ` <CACAvsv6SaRYhEp1QkWe_9H+XB1h8HQztZi-PP8FioE-1M2eAQA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
0 siblings, 1 reply; 4+ messages in thread
From: Ben Skeggs @ 2014-05-29 23:39 UTC (permalink / raw)
To: Martin Peres
Cc: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org,
Ben Skeggs
On Tue, May 27, 2014 at 7:15 PM, Martin Peres <martin.peres@free.fr> wrote:
> Le 03/04/2014 22:12, Martin Peres a écrit :
>
>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>> Signed-off-by: Martin Peres <martin.peres@free.fr>
>> ---
>> nvkm/subdev/bios/base.c | 9 +++++----
>> 1 file changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/nvkm/subdev/bios/base.c b/nvkm/subdev/bios/base.c
>> index 3de7d81..5f8643d 100644
>> --- a/nvkm/subdev/bios/base.c
>> +++ b/nvkm/subdev/bios/base.c
>> @@ -183,10 +183,11 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
>> goto out;
>>
>> bios->data = kmalloc(bios->size, GFP_KERNEL);
>> - if (bios->data) {
>> - for (i = 0; i < bios->size; i += 4)
>> - ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000
>> + i);
>> - }
>> + if (!bios->data)
>> + goto out;
>> +
>> + for (i = 0; i < bios->size; i += 4)
>> + ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
>>
>> /* check the PCI record header */
>> pcir = nv_ro16(bios, 0x0018);
>>
>
> This patch never got reviewed or pushed. It should also be sent as a fix for
> the next 3.15 rc, if possible.
Apologies, this was indeed overlooked. I've merged it. Thanks.
>
> _______________________________________________
> Nouveau mailing list
> Nouveau@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/nouveau
_______________________________________________
Nouveau mailing list
Nouveau@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/nouveau
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] bios: fix a potential NULL deref in the PROM shadowing function
[not found] ` <CACAvsv6SaRYhEp1QkWe_9H+XB1h8HQztZi-PP8FioE-1M2eAQA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
@ 2014-05-29 23:43 ` Martin Peres
0 siblings, 0 replies; 4+ messages in thread
From: Martin Peres @ 2014-05-29 23:43 UTC (permalink / raw)
To: Ben Skeggs
Cc: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org,
Ben Skeggs
On 30/05/2014 01:39, Ben Skeggs wrote:
> On Tue, May 27, 2014 at 7:15 PM, Martin Peres <martin.peres@free.fr> wrote:
>> Le 03/04/2014 22:12, Martin Peres a écrit :
>>
>>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>>> Signed-off-by: Martin Peres <martin.peres@free.fr>
>>> ---
>>> nvkm/subdev/bios/base.c | 9 +++++----
>>> 1 file changed, 5 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/nvkm/subdev/bios/base.c b/nvkm/subdev/bios/base.c
>>> index 3de7d81..5f8643d 100644
>>> --- a/nvkm/subdev/bios/base.c
>>> +++ b/nvkm/subdev/bios/base.c
>>> @@ -183,10 +183,11 @@ nouveau_bios_shadow_prom(struct nouveau_bios *bios)
>>> goto out;
>>>
>>> bios->data = kmalloc(bios->size, GFP_KERNEL);
>>> - if (bios->data) {
>>> - for (i = 0; i < bios->size; i += 4)
>>> - ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000
>>> + i);
>>> - }
>>> + if (!bios->data)
>>> + goto out;
>>> +
>>> + for (i = 0; i < bios->size; i += 4)
>>> + ((u32 *)bios->data)[i/4] = nv_rd32(bios, 0x300000 + i);
>>>
>>> /* check the PCI record header */
>>> pcir = nv_ro16(bios, 0x0018);
>>>
>> This patch never got reviewed or pushed. It should also be sent as a fix for
>> the next 3.15 rc, if possible.
> Apologies, this was indeed overlooked. I've merged it. Thanks.
And I should apologize too for not checking earlier :)
_______________________________________________
Nouveau mailing list
Nouveau@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/nouveau
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-05-29 23:43 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-04-03 20:12 [PATCH] bios: fix a potential NULL deref in the PROM shadowing function Martin Peres
[not found] ` <1396555961-2252-1-git-send-email-martin.peres-GANU6spQydw@public.gmane.org>
2014-05-27 9:15 ` Martin Peres
[not found] ` <538457CD.5080208-GANU6spQydw@public.gmane.org>
2014-05-29 23:39 ` Ben Skeggs
[not found] ` <CACAvsv6SaRYhEp1QkWe_9H+XB1h8HQztZi-PP8FioE-1M2eAQA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2014-05-29 23:43 ` Martin Peres
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.