linux-kernel - Re: [PATCH] net: ethernet: Fix phy_set_max

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <cdf1690e-c1a3-3b36-7a41-566b2f646f85@gmail.com>
Date:   Mon, 4 Mar 2019 15:40:52 -0800
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Aditya Pakki <pakki001@....edu>
Cc:     kjlu@....edu, Doug Berger <opendmb@...il.com>,
        "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: ethernet: Fix phy_set_max_speed by checking for NULL

On 3/4/19 3:36 PM, Aditya Pakki wrote:
> phy_device can be a NULL pointer which is further dereferenced
> downstream in phy_set_max_speed. This patch avoids such a scenario.
> 
> Signed-off-by: Aditya Pakki <pakki001@....edu>
> ---
>  drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
> index aceb9b7b55bd..7eaaecb53aa2 100644
> --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
> +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
> @@ -213,6 +213,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
>  		break;
>  
>  	case PHY_INTERFACE_MODE_MII:
> +		if (!phydev)
> +			return -ENODEV;

This is not where the error checking should go, it would be better to
move this in the caller of bcmgenet_mii_config(), that is
bcmgenet_mii_probe(), but there we already check that dev->phydev is non
NULL. The other code path where bcmgenet_mii_config() can be called is
from bcmgenet_resume(), which means the interface was sucessfully
registered and operation to begin with.

Was that flagged by some static analysis tool or human inspection?
-- 
Florian