Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 68293099 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by David S. Miller
Browse files

net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset 



Commit d8af4dfd ("net/tg3: Fix kernel crash") introduced a possible
NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
condition is met and netdev is NULL. Then, the jump to the 'done' label
calls dev_close() with a netdevice that is NULL. Therefore, only call
dev_close() when we have a netdevice, but one that is not running.

[ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
Nayak Sujir ]

Reported-by: default avatarDave Jones <davej@redhat.com>
Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
Cc: Michael Chan <mchan@broadcom.com>
Signed-off-by: default avatarNithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: default avatarNithin Nayak Sujir <nsujir@broadcom.com>
Signed-off-by: default avatarMichael Chan <mchan@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8a8e3d84

drivers/net/ethernet/broadcom/tg3.c

+8 −5
Original line number Diff line number Diff line
@@ -17796,8 +17796,10 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev, 


done:

	if (state == pci_channel_io_perm_failure) {

		if (netdev) {

			tg3_napi_enable(tp);

			dev_close(netdev);

		}

		err = PCI_ERS_RESULT_DISCONNECT;

	} else {

		pci_disable_device(pdev);
@@ -17827,7 +17829,8 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev) 
	rtnl_lock();



	if (pci_enable_device(pdev)) {

		netdev_err(netdev, "Cannot re-enable PCI device after reset.\n");

		dev_err(&pdev->dev,

			"Cannot re-enable PCI device after reset.\n");

		goto done;

	}
@@ -17835,7 +17838,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev) 
	pci_restore_state(pdev);

	pci_save_state(pdev);



	if (!netif_running(netdev)) {

	if (!netdev || !netif_running(netdev)) {

		rc = PCI_ERS_RESULT_RECOVERED;

		goto done;

	}
@@ -17847,7 +17850,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev) 
	rc = PCI_ERS_RESULT_RECOVERED;



done:

	if (rc != PCI_ERS_RESULT_RECOVERED && netif_running(netdev)) {

	if (rc != PCI_ERS_RESULT_RECOVERED && netdev && netif_running(netdev)) {

		tg3_napi_enable(tp);

		dev_close(netdev);

	}