linux-kernel - [PATCH] e1000: check the return of pci_get_drvdata() in e1000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 May 2018 17:17:43 -0700
From:   Bo Chen <chenbo@....edu>
To:     jeffrey.t.kirsher@...el.com
Cc:     davem@...emloft.net, intel-wired-lan@...ts.osuosl.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        Bo Chen <chenbo@....edu>
Subject: [PATCH] e1000: check the return of pci_get_drvdata() in e1000_remove()

This check on pci_get_drvdata() prevents potential invalid pointer dereferences,
and is a common practice in *_remove() functions from other drivers, such as
'intel/e100.c', 'amd/pcnet32.c', 'realtek/8139too.c', and 'broadcom/tg3.c'.

Signed-off-by: Bo Chen <chenbo@....edu>
---
 drivers/net/ethernet/intel/e1000/e1000_main.c | 41 ++++++++++---------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index d5eb19b86a0a..7f63360dd221 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -1283,32 +1283,35 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 static void e1000_remove(struct pci_dev *pdev)
 {
 	struct net_device *netdev = pci_get_drvdata(pdev);
-	struct e1000_adapter *adapter = netdev_priv(netdev);
-	struct e1000_hw *hw = &adapter->hw;
-	bool disable_dev;
 
-	e1000_down_and_stop(adapter);
-	e1000_release_manageability(adapter);
+	if (netdev) {
+		struct e1000_adapter *adapter = netdev_priv(netdev);
+		struct e1000_hw *hw = &adapter->hw;
+		bool disable_dev;
 
-	unregister_netdev(netdev);
+		e1000_down_and_stop(adapter);
+		e1000_release_manageability(adapter);
 
-	e1000_phy_hw_reset(hw);
+		unregister_netdev(netdev);
 
-	kfree(adapter->tx_ring);
-	kfree(adapter->rx_ring);
+		e1000_phy_hw_reset(hw);
 
-	if (hw->mac_type == e1000_ce4100)
-		iounmap(hw->ce4100_gbe_mdio_base_virt);
-	iounmap(hw->hw_addr);
-	if (hw->flash_address)
-		iounmap(hw->flash_address);
-	pci_release_selected_regions(pdev, adapter->bars);
+		kfree(adapter->tx_ring);
+		kfree(adapter->rx_ring);
 
-	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
-	free_netdev(netdev);
+		if (hw->mac_type == e1000_ce4100)
+			iounmap(hw->ce4100_gbe_mdio_base_virt);
+		iounmap(hw->hw_addr);
+		if (hw->flash_address)
+			iounmap(hw->flash_address);
+		pci_release_selected_regions(pdev, adapter->bars);
 
-	if (disable_dev)
-		pci_disable_device(pdev);
+		disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
+		free_netdev(netdev);
+
+		if (disable_dev)
+			pci_disable_device(pdev);
+	}
 }
 
 /**
-- 
2.17.0