Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d51842d authored by Jiasheng Jiang's avatar Jiasheng Jiang Committed by Greg Kroah-Hartman
Browse files

fsl/fman: Check for null pointer after calling devm_ioremap 



[ Upstream commit d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 ]

As the possible failure of the allocation, the devm_ioremap() may return
NULL pointer.
Take tgec_initialization() as an example.
If allocation fails, the params->base_addr will be NULL pointer and will
be assigned to tgec->regs in tgec_config().
Then it will cause the dereference of NULL pointer in set_mac_address(),
which is called by tgec_init().
Therefore, it should be better to add the sanity check after the calling
of the devm_ioremap().

Fixes: 39339616 ("fsl/fman: Add FMan MAC driver")
Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 9c275ff7

drivers/net/ethernet/freescale/fman/mac.c

+16 −5
Original line number Diff line number Diff line
@@ -96,7 +96,7 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex) 
		__func__, ex);

}



static void set_fman_mac_params(struct mac_device *mac_dev,

static int set_fman_mac_params(struct mac_device *mac_dev,

			       struct fman_mac_params *params)

{

	struct mac_priv_s *priv = mac_dev->priv;
@@ -104,6 +104,9 @@ static void set_fman_mac_params(struct mac_device *mac_dev, 
	params->base_addr = (typeof(params->base_addr))

		devm_ioremap(priv->dev, mac_dev->res->start,

			     resource_size(mac_dev->res));

	if (!params->base_addr)

		return -ENOMEM;



	memcpy(&params->addr, mac_dev->addr, sizeof(mac_dev->addr));

	params->max_speed	= priv->max_speed;

	params->phy_if		= priv->phy_if;
@@ -114,6 +117,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev, 
	params->event_cb	= mac_exception;

	params->dev_id		= mac_dev;

	params->internal_phy_node = priv->internal_phy_node;



	return 0;

}



static int tgec_initialization(struct mac_device *mac_dev)
@@ -125,7 +130,9 @@ static int tgec_initialization(struct mac_device *mac_dev) 


	priv = mac_dev->priv;



	set_fman_mac_params(mac_dev, &params);

	err = set_fman_mac_params(mac_dev, &params);

	if (err)

		goto _return;



	mac_dev->fman_mac = tgec_config(&params);

	if (!mac_dev->fman_mac) {
@@ -171,7 +178,9 @@ static int dtsec_initialization(struct mac_device *mac_dev) 


	priv = mac_dev->priv;



	set_fman_mac_params(mac_dev, &params);

	err = set_fman_mac_params(mac_dev, &params);

	if (err)

		goto _return;



	mac_dev->fman_mac = dtsec_config(&params);

	if (!mac_dev->fman_mac) {
@@ -220,7 +229,9 @@ static int memac_initialization(struct mac_device *mac_dev) 


	priv = mac_dev->priv;



	set_fman_mac_params(mac_dev, &params);

	err = set_fman_mac_params(mac_dev, &params);

	if (err)

		goto _return;



	if (priv->max_speed == SPEED_10000)

		params.phy_if = PHY_INTERFACE_MODE_XGMII;