netdev - Re: [PATCH net v2] tg3: Avoid NULL pointer dereference in tg3_io_error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 30 Sep 2016 01:28:10 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     gpiccoli@...ux.vnet.ibm.com
Cc:     siva.kallam@...adcom.com, prashant@...adcom.com,
        mchan@...adcom.com, netdev@...r.kernel.org, miltonm@...ibm.com
Subject: Re: [PATCH net v2] tg3: Avoid NULL pointer dereference in
 tg3_io_error_detected()

From: "Guilherme G. Piccoli" <gpiccoli@...ux.vnet.ibm.com>
Date: Thu, 29 Sep 2016 13:24:08 -0300

> From: Milton Miller <miltonm@...ibm.com>
> 
> While the driver is probing the adapter, an error may occur before the
> netdev structure is allocated and attached to pci_dev. In this case,
> not only netdev isn't available, but the tg3 private structure is also
> not available as it is just math from the NULL pointer, so dereferences
> must be skipped.
> 
> The following trace is seen when the error is triggered:
 ...
> This patch avoids the NULL pointer dereference by moving the access after
> the netdev NULL pointer check on tg3_io_error_detected(). Also, we add a
> check for netdev being NULL on tg3_io_resume() [suggested by Michael Chan].
> 
> Fixes: 0486a063b1ff ("tg3: prevent ifup/ifdown during PCI error recovery")
> Fixes: dfc8f370316b ("net/tg3: Release IRQs on permanent error")
> Tested-by: Guilherme G. Piccoli <gpiccoli@...ux.vnet.ibm.com>
> Signed-off-by: Milton Miller <miltonm@...ibm.com>
> Signed-off-by: Guilherme G. Piccoli <gpiccoli@...ux.vnet.ibm.com>
> ---
> 
>   * v2 changelog: added netdev NULL check on tg3_io_resume() as per
>     Michael Chan's suggestion.

Applied and queued up for -stable, thanks!