Path: csiph.com!news.mixmin.net!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod From: Andrew Lunn Newsgroups: linux.kernel Subject: Re: [patch] mdio_bus: NULL dereference on allocation error Date: Tue, 12 Jan 2016 15:10:02 +0100 Message-ID: References: X-Original-To: Dan Carpenter MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: robomod@news.nic.it List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Approved: robomod@news.nic.it Lines: 36 Organization: linux.* mail to news gateway X-Original-Cc: Florian Fainelli , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org X-Original-Date: Tue, 12 Jan 2016 15:06:47 +0100 X-Original-Message-ID: <20160112140647.GA5527@lunn.ch> X-Original-References: <20160112093435.GD29804@mwanda> X-Original-Sender: linux-kernel-owner@vger.kernel.org Xref: csiph.com linux.kernel:1307433 On Tue, Jan 12, 2016 at 12:34:36PM +0300, Dan Carpenter wrote: > If bus = kzalloc() fails then we end up dereferencing bus when we do > "bus->irq[i] = PHY_POLL;". The code is a little simpler if we reverse > the NULL check and return directly on failure. > > Fixes: e7f4dc3536a4 ('mdio: Move allocation of interrupts into core') > Signed-off-by: Dan Carpenter Reviewed-by: Andrew Lunn Thanks Andrew > > diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c > index 0be7b3d..0cba64f 100644 > --- a/drivers/net/phy/mdio_bus.c > +++ b/drivers/net/phy/mdio_bus.c > @@ -102,11 +102,12 @@ struct mii_bus *mdiobus_alloc_size(size_t size) > alloc_size = sizeof(*bus); > > bus = kzalloc(alloc_size, GFP_KERNEL); > - if (bus) { > - bus->state = MDIOBUS_ALLOCATED; > - if (size) > - bus->priv = (void *)bus + aligned_size; > - } > + if (!bus) > + return NULL; > + > + bus->state = MDIOBUS_ALLOCATED; > + if (size) > + bus->priv = (void *)bus + aligned_size; > > /* Initialise the interrupts to polling */ > for (i = 0; i < PHY_MAX_ADDR; i++)