From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 37E56CD6E57 for ; Thu, 4 Jun 2026 10:18:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:In-Reply-To:Content-Type: MIME-Version:References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=pUj7m2CDaW3G/ucn/7/SD3wFXRKZCFFvrBjYxGmN+is=; b=jsVSG62M0pJ6fHVr2113jRE+Hj lHIbEQNasXV4gohndwFUZtpmMe/CMnSKj5U6RZ5Rb9iw3eoFfeucoInr3KCI5oGujVs4j2g1eyQzr g/fyyCortd6v/IZ5dzPeOmYmEpbnFbs6ByUfYopfpzDWPueG9t8mNS1Cmn+CJOg6369sd5owGucwm Vsoh73393vNjUF/qT1XR2+EqsXfLQKLtvF/sdh+iKXulldRH7l8Whh/YkLDjYLS59Sr1WrZ4C/6gi vCV3MPxE7FyAQO9zZE0bgaO8sNQ4rZ4Ra98QXaH7kAsUMfpMrIAZb3uHNVh3ecHAiFWhJUiFItyLg L6f41FDQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wV59K-0000000GYpn-2w0n; Thu, 04 Jun 2026 10:18:06 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wV59J-0000000GYpY-0Gwt; Thu, 04 Jun 2026 10:18:05 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id C82E360219; Thu, 4 Jun 2026 10:18:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03F121F00893; Thu, 4 Jun 2026 10:18:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780568283; bh=pUj7m2CDaW3G/ucn/7/SD3wFXRKZCFFvrBjYxGmN+is=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=nzq2rcP1fx+yyhPnOyn2Rq5EpciyRCD4vPctNirtOQoDW5WlfuokxEuH+hpss8sJ8 XuqVFpGttKjbEU/tiRl8K/dZMpaX6+5eqh0RHpkkP0+6OweCCTW8vJI5hcXoeSNaSS 5I9q8T17WkGk5zvMZAOhag9Rwd/GiNIWsuOrSO6LSAT8emfcZOug74ZHaNaJ8TLgly N3IaWugx+FmOnkk2lBV6OQ0A5qrjkWqoT59ET04IjDxUrL0Oy+fbTieF1K+U3SL+Zy lnUK0I31pZgbfGpDGDQhfDvnYIUeEbJ68F5XgYweaZAUT8TBY31Tz2H7LedkRIo0Dd wR3AvuQ9yVpMg== Date: Thu, 4 Jun 2026 12:18:01 +0200 From: Lorenzo Bianconi To: ZhaoJinming Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH net] net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues() Message-ID: References: <20260604070352.2603077-1-zhaojinming@uniontech.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="MHS1sKb/1YHuFP2O" Content-Disposition: inline In-Reply-To: <20260604070352.2603077-1-zhaojinming@uniontech.com> X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org --MHS1sKb/1YHuFP2O Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable > of_reserved_mem_lookup() may return NULL if the reserved memory region > referenced by the "memory-region" phandle is not found in the reserved > memory table (e.g. due to a misconfigured DTS or a removed > memory-region node). The current code dereferences the returned > pointer without checking for NULL, leading to a kernel NULL pointer > dereference at the following lines: >=20 > dma_addr =3D rmem->base; // line 1156 > num_desc =3D div_u64(rmem->size, buf_size); // line 1160 >=20 > Add a NULL check after of_reserved_mem_lookup() and return -ENODEV if > the lookup fails, which is consistent with the existing error handling > for of_parse_phandle() failure in the same code block. >=20 > Fixes: 3a1ce9e3d01b ("net: airoha: Add the capability to allocate hwfd bu= ffers via reserved-memory") > Cc: stable@vger.kernel.org > Signed-off-by: ZhaoJinming Acked-by: Lorenzo Bianconi > --- > drivers/net/ethernet/airoha/airoha_eth.c | 3 +++ > 1 file changed, 3 insertions(+) >=20 > diff --git a/drivers/net/ethernet/airoha/airoha_eth.c b/drivers/net/ether= net/airoha/airoha_eth.c > index cecd66251dba..2444d3275a81 100644 > --- a/drivers/net/ethernet/airoha/airoha_eth.c > +++ b/drivers/net/ethernet/airoha/airoha_eth.c > @@ -1153,6 +1153,9 @@ static int airoha_qdma_init_hfwd_queues(struct airo= ha_qdma *qdma) > =20 > rmem =3D of_reserved_mem_lookup(np); > of_node_put(np); > + if (!rmem) > + return -ENODEV; > + > dma_addr =3D rmem->base; > /* Compute the number of hw descriptors according to the > * reserved memory size and the payload buffer size > --=20 > 2.25.1 --MHS1sKb/1YHuFP2O Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTquNwa3Txd3rGGn7Y6cBh0uS2trAUCaiFQ2QAKCRA6cBh0uS2t rGQoAP0Y+U3xaU4dH4A4qEA5eXkvOPfKybpxGlsEg1dZFVcKfgD/fEwzNgGlnKUX 1JLWfHZ0UTnNgp7WgqnMb40Sm39fpgM= =v7Zm -----END PGP SIGNATURE----- --MHS1sKb/1YHuFP2O--