netdev - Re: [PATCH V2 1/2] e100 in linux-3.18.0: Fix null pointer deference in e100

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5496D2F9.4070306@cogentembedded.com>
Date:	Sun, 21 Dec 2014 17:02:33 +0300
From:	Sergei Shtylyov <sergei.shtylyov@...entembedded.com>
To:	Jia-Ju Bai <baijiaju1990@....com>,
	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
CC:	todd.fujinaka@...el.com, Linux-nics@...tope.jf.intel.com,
	linux.nics@...el.com, e1000-devel@...ts.sourceforge.net
Subject: Re: [PATCH V2 1/2] e100 in linux-3.18.0: Fix null pointer deference
 in e100_probe

On 12/21/2014 4:19 AM, Jia-Ju Bai wrote:

    Please don't send HTML to this mailing list -- your mail may be ignored by 
the list server.

> The driver lacks the check of nic->cbs_pool after pci_pool_create in e100_probe. So when this function is failed, the null pointer dereference occurs when pci_pool_alloc uses nic->cbs_pool in e100_alloc_cbs.

    Same comment as for the previous patch about wrapping at 80 columns.

> This patch fix this problem, and it has been tested in runtime.

> Signed-off-by: Jia-Ju Bai<baijiaju1990@....com>
> ---
>   drivers/net/ethernet/intel/e100.c     |   6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
> index 781065e..ba1813f 100644
> --- a/drivers/net/ethernet/intel/e100.c
> +++ b/drivers/net/ethernet/intel/e100.c
> @@ -2969,6 +2969,10 @@ static int e100_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>                 nic->params.cbs.max * sizeof(struct cb),
>                 sizeof(u32),
>                 0);
> +   if (!nic->cbs_pool) {
> +       err = -ENOMEM;
> +       goto err_out_pool;
> +   }

    Looks like tabs got converted to spaces by your mailer, thus the patch 
can't be applied. Consider using 'git send-email' instead.

[...]

WBR, Sergei

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html