From mboxrd@z Thu Jan 1 00:00:00 1970 From: YueHaibing Subject: Re: [PATCH net-next] net: fddi: fix a possible null-ptr-deref Date: Tue, 5 Jun 2018 21:08:14 +0800 Message-ID: References: <20180605100627.16184-1-yuehaibing@huawei.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Cc: , To: Return-path: In-Reply-To: <20180605100627.16184-1-yuehaibing@huawei.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On 2018/6/5 18:06, YueHaibing wrote: > bp->SharedMemAddr is set to NULL while bp->SharedMemSize less than 0, > then memset will trigger null-ptr-deref. > > Fix it use pci_zalloc_consistent when bp->SharedMemSize is greater than 0. > > Signed-off-by: YueHaibing > --- > drivers/net/fddi/skfp/skfddi.c | 10 ++++------ > 1 file changed, 4 insertions(+), 6 deletions(-) > > diff --git a/drivers/net/fddi/skfp/skfddi.c b/drivers/net/fddi/skfp/skfddi.c > index 2414f1d..90164e0 100644 > --- a/drivers/net/fddi/skfp/skfddi.c > +++ b/drivers/net/fddi/skfp/skfddi.c > @@ -407,23 +407,21 @@ static int skfp_driver_init(struct net_device *dev) > if (bp->SharedMemSize > 0) { > bp->SharedMemSize += 16; // for descriptor alignment > > - bp->SharedMemAddr = pci_alloc_consistent(&bp->pdev, > - bp->SharedMemSize, > - &bp->SharedMemDMA); > + bp->SharedMemAddr = pci_zalloc_consistent(&bp->pdev, > + bp->SharedMemSize, > + &bp->SharedMemDMA); This also need move from pci_dma* to dma_*, will send v2 > if (!bp->SharedMemAddr) { > printk("could not allocate mem for "); > printk("hardware module: %ld byte\n", > bp->SharedMemSize); > goto fail; > } > - bp->SharedMemHeap = 0; // Nothing used yet. > > } else { > bp->SharedMemAddr = NULL; > - bp->SharedMemHeap = 0; > } // SharedMemSize > 0 > > - memset(bp->SharedMemAddr, 0, bp->SharedMemSize); > + bp->SharedMemHeap = 0; > > card_stop(smc); // Reset adapter. > >