[PATCH 4.9 050/157] fsl/fman: Check for null pointer after calling devm_ioremap

From: Jiasheng Jiang jiasheng@iscas.ac.cn

[ Upstream commit d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 ]

As the possible failure of the allocation, the devm_ioremap() may return NULL pointer. Take tgec_initialization() as an example. If allocation fails, the params->base_addr will be NULL pointer and will be assigned to tgec->regs in tgec_config(). Then it will cause the dereference of NULL pointer in set_mac_address(), which is called by tgec_init(). Therefore, it should be better to add the sanity check after the calling of the devm_ioremap().

Fixes: 3933961682a3 ("fsl/fman: Add FMan MAC driver") Signed-off-by: Jiasheng Jiang jiasheng@iscas.ac.cn Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/freescale/fman/mac.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c index 81021f87e4f39..93b7ed361b82e 100644 --- a/drivers/net/ethernet/freescale/fman/mac.c +++ b/drivers/net/ethernet/freescale/fman/mac.c @@ -96,14 +96,17 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex) __func__, ex); }

-static void set_fman_mac_params(struct mac_device *mac_dev, - struct fman_mac_params *params) +static int set_fman_mac_params(struct mac_device *mac_dev, + struct fman_mac_params *params) { struct mac_priv_s *priv = mac_dev->priv;

params->base_addr = (typeof(params->base_addr)) devm_ioremap(priv->dev, mac_dev->res->start, resource_size(mac_dev->res)); + if (!params->base_addr) + return -ENOMEM; + memcpy(&params->addr, mac_dev->addr, sizeof(mac_dev->addr)); params->max_speed = priv->max_speed; params->phy_if = priv->phy_if; @@ -114,6 +117,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev, params->event_cb = mac_exception; params->dev_id = mac_dev; params->internal_phy_node = priv->internal_phy_node; + + return 0; }

static int tgec_initialization(struct mac_device *mac_dev) @@ -125,7 +130,9 @@ static int tgec_initialization(struct mac_device *mac_dev)

priv = mac_dev->priv;

- set_fman_mac_params(mac_dev, &params); + err = set_fman_mac_params(mac_dev, &params); + if (err) + goto _return;

mac_dev->fman_mac = tgec_config(&params); if (!mac_dev->fman_mac) { @@ -171,7 +178,9 @@ static int dtsec_initialization(struct mac_device *mac_dev)

priv = mac_dev->priv;

- set_fman_mac_params(mac_dev, &params); + err = set_fman_mac_params(mac_dev, &params); + if (err) + goto _return;

mac_dev->fman_mac = dtsec_config(&params); if (!mac_dev->fman_mac) { @@ -220,7 +229,9 @@ static int memac_initialization(struct mac_device *mac_dev)

priv = mac_dev->priv;

- set_fman_mac_params(mac_dev, &params); + err = set_fman_mac_params(mac_dev, &params); + if (err) + goto _return;

if (priv->max_speed == SPEED_10000) params.phy_if = PHY_INTERFACE_MODE_XGMII;