From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
To: davem@davemloft.net
Cc: Jia-Ju Bai <baijiaju1990@163.com>,
netdev@vger.kernel.org, nhorman@redhat.com, sassmann@redhat.com,
jogreene@redhat.com, Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Subject: [net-next 07/15] e100: Add a check after pci_pool_create to avoid null pointer dereference
Date: Tue, 18 Aug 2015 14:09:14 -0700 [thread overview]
Message-ID: <1439932162-1995-8-git-send-email-jeffrey.t.kirsher@intel.com> (raw)
In-Reply-To: <1439932162-1995-1-git-send-email-jeffrey.t.kirsher@intel.com>
From: Jia-Ju Bai <baijiaju1990@163.com>
The driver lacks the check of nic->cbs_pool after pci_pool_create
in e100_probe. When this function is failed, a null pointer dereference
occurs when pci_pool_alloc uses nic->cbs_pool in e100_alloc_cbs.
This patch adds a check and related error handling code to fix it.
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
---
drivers/net/ethernet/intel/e100.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index d2657a4..767c161 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -2967,6 +2967,11 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
nic->params.cbs.max * sizeof(struct cb),
sizeof(u32),
0);
+ if (!nic->cbs_pool) {
+ netif_err(nic, probe, nic->netdev, "Cannot create DMA pool, aborting\n");
+ err = -ENOMEM;
+ goto err_out_pool;
+ }
netif_info(nic, probe, nic->netdev,
"addr 0x%llx, irq %d, MAC addr %pM\n",
(unsigned long long)pci_resource_start(pdev, use_io ? 1 : 0),
@@ -2974,6 +2979,8 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
return 0;
+err_out_pool:
+ unregister_netdev(netdev);
err_out_free:
e100_free(nic);
err_out_iounmap:
--
2.4.3
next prev parent reply other threads:[~2015-08-18 21:09 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-18 21:09 [net-next 00/15][pull request] Intel Wired LAN Driver Updates 2015-08-18 Jeff Kirsher
2015-08-18 21:09 ` [net-next 01/15] igb: Fix oops caused by missing queue pairing Jeff Kirsher
2015-08-18 21:09 ` [net-next 02/15] igb: missing rtnl_unlock in igb_sriov_reinit() Jeff Kirsher
2015-08-18 21:09 ` [net-next 03/15] igb: do not re-init SR-IOV during probe Jeff Kirsher
2015-08-18 21:09 ` [net-next 04/15] igb: implement high frequency periodic output signals Jeff Kirsher
2015-08-18 21:09 ` [net-next 05/15] igb: add support for 1512 PHY Jeff Kirsher
2015-08-18 21:09 ` [net-next 06/15] igb: Teardown SR-IOV before unregister_netdev() Jeff Kirsher
2015-08-18 21:09 ` Jeff Kirsher [this message]
2015-08-18 21:09 ` [net-next 08/15] e100: Release skb when DMA mapping is failed in e100_xmit_prepare Jeff Kirsher
2015-08-18 21:09 ` [net-next 09/15] igb: Fix a deadlock in igb_sriov_reinit Jeff Kirsher
2015-08-18 21:09 ` [net-next 10/15] e1000e: Modify Tx/Rx configurations to avoid null pointer dereferences in e1000_open Jeff Kirsher
2015-08-18 21:09 ` [net-next 11/15] igb: Fix a memory leak in igb_probe Jeff Kirsher
2015-08-18 21:09 ` [net-next 12/15] igbvf: clear buffer_info->dma after dma_unmap_single() Jeff Kirsher
2015-08-18 21:09 ` [net-next 13/15] igb: make sure SR-IOV init uses the right number of queues Jeff Kirsher
2015-08-18 21:09 ` [net-next 14/15] ixgbe: Simplify port-specific macros Jeff Kirsher
2015-08-18 21:09 ` [net-next 15/15] ixgbe: TRIVIAL fix up double 'the' and comment style Jeff Kirsher
2015-08-19 3:21 ` [net-next 00/15][pull request] Intel Wired LAN Driver Updates 2015-08-18 David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1439932162-1995-8-git-send-email-jeffrey.t.kirsher@intel.com \
--to=jeffrey.t.kirsher@intel.com \
--cc=baijiaju1990@163.com \
--cc=davem@davemloft.net \
--cc=jogreene@redhat.com \
--cc=netdev@vger.kernel.org \
--cc=nhorman@redhat.com \
--cc=sassmann@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).