fsl/fman: Check for null pointer after calling devm_ioremap

BugLink: https://bugs.launchpad.net/bugs/1960566
[ Upstream commit d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 ]

As the possible failure of the allocation, the devm_ioremap() may return
NULL pointer.
Take tgec_initialization() as an example.
If allocation fails, the params->base_addr will be NULL pointer and will
be assigned to tgec->regs in tgec_config().
Then it will cause the dereference of NULL pointer in set_mac_address(),
which is called by tgec_init().
Therefore, it should be better to add the sanity check after the calling
of the devm_ioremap().

Fixes: 3933961682a3 ("fsl/fman: Add FMan MAC driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 7ab8095db1928a68a36810161d644b0b0b60c260..147126e79986c8de0c98b3ae469fc2a4aab05bea 100644 (file)
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -94,14 +94,17 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex)
                __func__, ex);
 }
 
-static void set_fman_mac_params(struct mac_device *mac_dev,
-                               struct fman_mac_params *params)
+static int set_fman_mac_params(struct mac_device *mac_dev,
+                              struct fman_mac_params *params)
 {
        struct mac_priv_s *priv = mac_dev->priv;
 
        params->base_addr = (typeof(params->base_addr))
                devm_ioremap(priv->dev, mac_dev->res->start,
                             resource_size(mac_dev->res));
+       if (!params->base_addr)
+               return -ENOMEM;
+
        memcpy(&params->addr, mac_dev->addr, sizeof(mac_dev->addr));
        params->max_speed       = priv->max_speed;
        params->phy_if          = mac_dev->phy_if;
@@ -112,6 +115,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev,
        params->event_cb        = mac_exception;
        params->dev_id          = mac_dev;
        params->internal_phy_node = priv->internal_phy_node;
+
+       return 0;
 }
 
 static int tgec_initialization(struct mac_device *mac_dev)
@@ -123,7 +128,9 @@ static int tgec_initialization(struct mac_device *mac_dev)
 
        priv = mac_dev->priv;
 
-       set_fman_mac_params(mac_dev, &params);
+       err = set_fman_mac_params(mac_dev, &params);
+       if (err)
+               goto _return;
 
        mac_dev->fman_mac = tgec_config(&params);
        if (!mac_dev->fman_mac) {
@@ -169,7 +176,9 @@ static int dtsec_initialization(struct mac_device *mac_dev)
 
        priv = mac_dev->priv;
 
-       set_fman_mac_params(mac_dev, &params);
+       err = set_fman_mac_params(mac_dev, &params);
+       if (err)
+               goto _return;
 
        mac_dev->fman_mac = dtsec_config(&params);
        if (!mac_dev->fman_mac) {
@@ -218,7 +227,9 @@ static int memac_initialization(struct mac_device *mac_dev)
 
        priv = mac_dev->priv;
 
-       set_fman_mac_params(mac_dev, &params);
+       err = set_fman_mac_params(mac_dev, &params);
+       if (err)
+               goto _return;
 
        if (priv->max_speed == SPEED_10000)
                params.phy_if = PHY_INTERFACE_MODE_XGMII;