From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3FE97C25B74 for ; Tue, 21 May 2024 13:48:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=qagzHD+7ghz7cviCuViC+6U+Nnq3mgYtQyDCSfvJwcM=; b=Rhjx/02Su9lQeV g5cppHToSiDItIFOKduVMYNJqclo1W9Cdj8cByE42NMeo4ne0jPh5TXjQnkza9YlMoF4Ib4fj/V7x nya2ud0w2dNNSyrHiUvDkf3WG9DkxK78y8ruD0OMVMDtiJcMCC+HimIv4/m1eq9E1gnVxL66xMw55 Rcn3FK+2+pvXOcMNAL1apF/eCaS3ejBB8rab9BkYioupdW9LcHOKECJtWYqfp8/D5DCo0LFn8lxY5 7LQwcYPdXe1rf01G+c4smzM7B1AYGe1383V3Z8fG545BMrKvod8GbQhM+u8S7MNcprlia0naETG+5 w++00wc1FjChvH/Y7wKw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1s9PqI-0000000031b-0ted; Tue, 21 May 2024 13:47:50 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1s9PqE-0000000031A-35qS for linux-arm-kernel@lists.infradead.org; Tue, 21 May 2024 13:47:48 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id 3AEB262250; Tue, 21 May 2024 13:47:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CEC6CC2BD11; Tue, 21 May 2024 13:47:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1716299264; bh=Rs0778QKzKCdk0BVA98zOTHQl+mRFeefvwXEHJ/1we8=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=RdnWDP7adAioYkB3/+Il09h51NgpF8SMAVZyOlo4p1vHsDU8W/MmkscYN3ZaqPUvh LJJyfhttBT1gQbWzZA65iJeGWv8wz+cfco9WKnizzAj4wSwPNVeM6kXOtfvJ4VxIC/ dKTVtxVgFa0pORmupAShSMqwC9XPkDPG0YVZBHckGuCWfwRbis10RHmhNEm6ZftgNK GZp1T6A/upBmVnSxgjJoNZU+xemHpmENftx9Etor5hVqexWIToaxjbOpVh+eYiI2Mm fFfbLAACqP4MQk/LeEay0vniuHCpwirjQeLw/3fxCUglIuP+4KEpcYTmG6SEWS1+Es O1BAaRNoj3u9A== Date: Tue, 21 May 2024 14:47:39 +0100 From: Simon Horman To: Romain Gantois Cc: MD Danish Anwar , Roger Quadros , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Thomas Petazzoni , linux-arm-kernel@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Andrew Lunn , Diogo Ivo , Vignesh Raghavendra Subject: Re: [PATCH net] net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe() Message-ID: <20240521134739.GE764145@kernel.org> References: <20240521-icssg-prueth-fix-v1-1-b4b17b1433e9@bootlin.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20240521-icssg-prueth-fix-v1-1-b4b17b1433e9@bootlin.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240521_064746_958170_0C38194E X-CRM114-Status: GOOD ( 29.22 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org + Andrew Lunn, Diogo Ivo, Vignesh Raghavendra Not trimming reply to provide context for these people On Tue, May 21, 2024 at 02:44:11PM +0200, Romain Gantois wrote: > In the prueth_probe() function, if one of the calls to emac_phy_connect() > fails due to of_phy_connect() returning NULL, then the subsequent call to > phy_attached_info() will dereference a NULL pointer. > > Check the return code of emac_phy_connect and fail cleanly if there is an > error. > > Fixes: 128d5874c082 ("net: ti: icssg-prueth: Add ICSSG ethernet driver") > Cc: stable@vger.kernel.org > Signed-off-by: Romain Gantois For Networking patches, please consider seeding the CC list using ./scripts/get_maintainer.pl this.patch. I've added the people who seemed to be missing. The patch itself looks good to me. Reviewed-by: Simon Horman > --- > Hello everyone, > > There is a possible NULL pointer dereference in the prueth_probe() function of > the icssg_prueth driver. I discovered this while testing a platform with one > PRUETH MAC enabled out of the two available. > > These are the requirements to reproduce the bug: > > prueth_probe() is called > either eth0_node or eth1_node is not NULL > in emac_phy_connect: of_phy_connect() returns NULL > > Then, the following leads to the NULL pointer dereference: > > prueth->emac[PRUETH_MAC0]->ndev->phydev is set to NULL > prueth->emac[PRUETH_MAC0]->ndev->phydev is passed to phy_attached_info() > -> phy_attached_print() dereferences phydev which is NULL > > This series provides a fix by checking the return code of emac_phy_connect(). > > Best Regards, > > Romain > --- > drivers/net/ethernet/ti/icssg/icssg_prueth.c | 14 ++++++++++++-- > 1 file changed, 12 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/ti/icssg/icssg_prueth.c b/drivers/net/ethernet/ti/icssg/icssg_prueth.c > index 7c9e9518f555a..1ea3fbd5e954e 100644 > --- a/drivers/net/ethernet/ti/icssg/icssg_prueth.c > +++ b/drivers/net/ethernet/ti/icssg/icssg_prueth.c > @@ -1039,7 +1039,12 @@ static int prueth_probe(struct platform_device *pdev) > > prueth->registered_netdevs[PRUETH_MAC0] = prueth->emac[PRUETH_MAC0]->ndev; > > - emac_phy_connect(prueth->emac[PRUETH_MAC0]); > + ret = emac_phy_connect(prueth->emac[PRUETH_MAC0]); > + if (ret) { > + dev_err(dev, > + "can't connect to MII0 PHY, error -%d", ret); > + goto netdev_unregister; > + } > phy_attached_info(prueth->emac[PRUETH_MAC0]->ndev->phydev); > } > > @@ -1051,7 +1056,12 @@ static int prueth_probe(struct platform_device *pdev) > } > > prueth->registered_netdevs[PRUETH_MAC1] = prueth->emac[PRUETH_MAC1]->ndev; > - emac_phy_connect(prueth->emac[PRUETH_MAC1]); > + ret = emac_phy_connect(prueth->emac[PRUETH_MAC1]); > + if (ret) { > + dev_err(dev, > + "can't connect to MII1 PHY, error %d", ret); > + goto netdev_unregister; > + } > phy_attached_info(prueth->emac[PRUETH_MAC1]->ndev->phydev); > } > > > --- > base-commit: e4a87abf588536d1cdfb128595e6e680af5cf3ed > change-id: 20240521-icssg-prueth-fix-03b03064c5ce > > Best regards, > -- > Romain Gantois > > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel