linux-kernel - Re: [PATCH 1/1] net: thunderx: avoid null pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <573B7D39.9050305@caviumnetworks.com>
Date:	Tue, 17 May 2016 13:21:13 -0700
From:	David Daney <ddaney@...iumnetworks.com>
To:	Heinrich Schuchardt <xypron.glpk@....de>
CC:	Sunil Goutham <sgoutham@...ium.com>,
	Robert Richter <rric@...nel.org>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>,
	<linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH 1/1] net: thunderx: avoid null pointer dereference

On 05/17/2016 12:40 PM, Heinrich Schuchardt wrote:
> In function bgx_lmac_handler only use a member of
> lmac after checking it is not null.
>

Were you seeing and actual OOPs, or is this only a theoretical problem 
flagged by some sort of static code checker?

> Signed-off-by: Heinrich Schuchardt <xypron.glpk@....de>

In any event, it seems sane to make this change, so:

Acked-by: David Daney <david.daney@...ium.com>


> ---
>   drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
> index d20539a..3ed2198 100644
> --- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
> +++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
> @@ -274,12 +274,14 @@ static void bgx_sgmii_change_link_state(struct lmac *lmac)
>   static void bgx_lmac_handler(struct net_device *netdev)
>   {
>   	struct lmac *lmac = container_of(netdev, struct lmac, netdev);
> -	struct phy_device *phydev = lmac->phydev;
> +	struct phy_device *phydev;
>   	int link_changed = 0;
>
>   	if (!lmac)
>   		return;
>
> +	phydev = lmac->phydev;
> +
>   	if (!phydev->link && lmac->last_link)
>   		link_changed = -1;
>
>