Patches contributed by University of Minnesota

<<Prev 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19[20]21 22 23 24 25 26 27 28 29 30 Next>>

commit 5bf7295fe34a5251b1d241b9736af4697b590670
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Thu Mar 14 15:31:40 2019 -0500

    qlcnic: Avoid potential NULL pointer dereference
    
    netdev_alloc_skb can fail and return a NULL pointer which is
    dereferenced without a check. The patch avoids such a scenario.
    
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 3b0adda7cc9c..a4cd6f2cfb86 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1048,6 +1048,8 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode)
 
 	for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
 		skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
+		if (!skb)
+			break;
 		qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
 		skb_put(skb, QLCNIC_ILB_PKT_SIZE);
 		adapter->ahw->diag_cnt = 0;

commit a2c6433ee5a35a8de6d563f6512a26f87835ea0f
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Mon Mar 4 17:00:02 2019 -0600

    ALSA: usx2y: Fix potential NULL pointer dereference
    
    usb_alloc_urb() can fail due to kmalloc failure and push the error
    upstream. Further this can cause a NULL pointer dereference in
    init_pipe_urbs(). This patch avoids such a scenario.
    
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
index b0f8979ff2d2..221adf68bd0c 100644
--- a/sound/usb/usx2y/usb_stream.c
+++ b/sound/usb/usx2y/usb_stream.c
@@ -104,7 +104,12 @@ static int init_urbs(struct usb_stream_kernel *sk, unsigned use_packsize,
 
 	for (u = 0; u < USB_STREAM_NURBS; ++u) {
 		sk->inurb[u] = usb_alloc_urb(sk->n_o_ps, GFP_KERNEL);
+		if (!sk->inurb[u])
+			return -ENOMEM;
+
 		sk->outurb[u] = usb_alloc_urb(sk->n_o_ps, GFP_KERNEL);
+		if (!sk->outurb[u])
+			return -ENOMEM;
 	}
 
 	if (init_pipe_urbs(sk, use_packsize, sk->inurb, indata, dev, in_pipe) ||

commit 2795e8c251614ac0784c9d41008551109f665716
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Mon Mar 11 02:25:17 2019 -0500

    net: ieee802154: fix a potential NULL pointer dereference
    
    In case alloc_ordered_workqueue fails, the fix releases
    sources and returns -ENOMEM to avoid NULL pointer dereference.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Acked-by: Michael Hennerich <michael.hennerich@analog.com>
    Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>

diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
index cd1d8faccca5..cd6b95e673a5 100644
--- a/drivers/net/ieee802154/adf7242.c
+++ b/drivers/net/ieee802154/adf7242.c
@@ -1268,6 +1268,10 @@ static int adf7242_probe(struct spi_device *spi)
 	INIT_DELAYED_WORK(&lp->work, adf7242_rx_cal_work);
 	lp->wqueue = alloc_ordered_workqueue(dev_name(&spi->dev),
 					     WQ_MEM_RECLAIM);
+	if (unlikely(!lp->wqueue)) {
+		ret = -ENOMEM;
+		goto err_hw_init;
+	}
 
 	ret = adf7242_hw_init(lp);
 	if (ret)

commit 4ec850e5dfec092b26cf3b7d5a6c9e444ea4babd
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Tue Mar 12 02:50:40 2019 -0500

    net: dwmac-sun8i: fix a missing check of of_get_phy_mode
    
    of_get_phy_mode may fail and return a negative error code;
    the fix checks the return value of of_get_phy_mode and
    returns -EINVAL of it fails.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index 0f660af01a4b..195669f550f0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -1147,7 +1147,10 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
 		return ret;
 	}
 
-	plat_dat->interface = of_get_phy_mode(dev->of_node);
+	ret = of_get_phy_mode(dev->of_node);
+	if (ret < 0)
+		return -EINVAL;
+	plat_dat->interface = ret;
 
 	/* platform data specifying hardware features and callbacks.
 	 * hardware features were copied from Allwinner drivers.

commit 035a14e71f27eefa50087963b94cbdb3580d08bf
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Tue Mar 12 02:43:18 2019 -0500

    net: sh_eth: fix a missing check of of_get_phy_mode
    
    of_get_phy_mode may fail and return a negative error code;
    the fix checks the return value of of_get_phy_mode and
    returns NULL of it fails.
    
    Fixes: b356e978e92f ("sh_eth: add device tree support")
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 339b2eae2100..e33af371b169 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -3181,12 +3181,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
 	struct device_node *np = dev->of_node;
 	struct sh_eth_plat_data *pdata;
 	const char *mac_addr;
+	int ret;
 
 	pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return NULL;
 
-	pdata->phy_interface = of_get_phy_mode(np);
+	ret = of_get_phy_mode(np);
+	if (ret < 0)
+		return NULL;
+	pdata->phy_interface = ret;
 
 	mac_addr = of_get_mac_address(np);
 	if (mac_addr)

commit c7cbc3e937b885c9394bf9d0ca21ceb75c2ac262
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Tue Mar 12 02:24:07 2019 -0500

    net: 8390: fix potential NULL pointer dereferences
    
    In case ioremap fails, the fix releases resources and returns
    to avoid NULL pointer dereferences.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/8390/pcnet_cs.c b/drivers/net/ethernet/8390/pcnet_cs.c
index 61e43802b9a5..645efac6310d 100644
--- a/drivers/net/ethernet/8390/pcnet_cs.c
+++ b/drivers/net/ethernet/8390/pcnet_cs.c
@@ -289,6 +289,11 @@ static struct hw_info *get_hwinfo(struct pcmcia_device *link)
 
     virt = ioremap(link->resource[2]->start,
 	    resource_size(link->resource[2]));
+    if (unlikely(!virt)) {
+	    pcmcia_release_window(link, link->resource[2]);
+	    return NULL;
+    }
+
     for (i = 0; i < NR_INFO; i++) {
 	pcmcia_map_mem_page(link, link->resource[2],
 		hw_info[i].offset & ~(resource_size(link->resource[2])-1));
@@ -1423,6 +1428,11 @@ static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
     /* Try scribbling on the buffer */
     info->base = ioremap(link->resource[3]->start,
 			resource_size(link->resource[3]));
+    if (unlikely(!info->base)) {
+	    ret = -ENOMEM;
+	    goto failed;
+    }
+
     for (i = 0; i < (TX_PAGES<<8); i += 2)
 	__raw_writew((i>>1), info->base+offset+i);
     udelay(100);

commit 9f4d6358e11bbc7b839f9419636188e4151fb6e4
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Tue Mar 12 02:16:21 2019 -0500

    net: fujitsu: fix a potential NULL pointer dereference
    
    In case ioremap fails, the fix releases the pcmcia window and
    returns -ENOMEM to avoid the NULL pointer dereference.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
index a69cd19a55ae..1eca0fdb9933 100644
--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
+++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c
@@ -547,6 +547,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id)
 	return -1;
 
     base = ioremap(link->resource[2]->start, resource_size(link->resource[2]));
+    if (!base) {
+	    pcmcia_release_window(link, link->resource[2]);
+	    return -ENOMEM;
+    }
+
     pcmcia_map_mem_page(link, link->resource[2], 0);
 
     /*

commit eb32cfcdef2305dc0e44a65d42801315669bb27e
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Tue Mar 12 02:06:47 2019 -0500

    net: qlogic: fix a potential NULL pointer dereference
    
    In case create_singlethread_workqueue fails, the fix returns
    -ENOMEM to avoid NULL pointer dereference.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 10b075bc5959..b61b88cbc0c7 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3886,6 +3886,12 @@ static int ql3xxx_probe(struct pci_dev *pdev,
 	netif_stop_queue(ndev);
 
 	qdev->workqueue = create_singlethread_workqueue(ndev->name);
+	if (!qdev->workqueue) {
+		unregister_netdev(ndev);
+		err = -ENOMEM;
+		goto err_out_iounmap;
+	}
+
 	INIT_DELAYED_WORK(&qdev->reset_work, ql_reset_work);
 	INIT_DELAYED_WORK(&qdev->tx_timeout_work, ql_tx_timeout_work);
 	INIT_DELAYED_WORK(&qdev->link_state_work, ql_link_state_machine_work);

commit 10010493c1261ca3d7444d372f281009890a5ff7
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Tue Mar 12 00:54:55 2019 -0500

    isdn: hfcpci: fix potential NULL pointer dereference
    
    In case ioremap fails, the fix releases resources and returns.
    The following printk is for logging purpose and thus is
    preserved.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index ebb3fa2e1d00..362aa5450a5e 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -2032,10 +2032,19 @@ setup_hw(struct hfc_pci *hc)
 	hc->hw.fifos = buffer;
 	pci_write_config_dword(hc->pdev, 0x80, hc->hw.dmahandle);
 	hc->hw.pci_io = ioremap((ulong) hc->hw.pci_io, 256);
+	if (unlikely(!hc->hw.pci_io)) {
+		printk(KERN_WARNING
+		       "HFC-PCI: Error in ioremap for PCI!\n");
+		pci_free_consistent(hc->pdev, 0x8000, hc->hw.fifos,
+				    hc->hw.dmahandle);
+		return 1;
+	}
+
 	printk(KERN_INFO
 	       "HFC-PCI: defined at mem %#lx fifo %#lx(%#lx) IRQ %d HZ %d\n",
 	       (u_long) hc->hw.pci_io, (u_long) hc->hw.fifos,
 	       (u_long) hc->hw.dmahandle, hc->irq, HZ);
+
 	/* enable memory mapped ports, disable busmaster */
 	pci_write_config_word(hc->pdev, PCI_COMMAND, PCI_ENA_MEMIO);
 	hc->hw.int_m2 = 0;

commit e406f12dde1a8375d77ea02d91f313fb1a9c6aec
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Mon Mar 4 16:48:54 2019 -0600

    md: Fix failed allocation of md_register_thread
    
    mddev->sync_thread can be set to NULL on kzalloc failure downstream.
    The patch checks for such a scenario and frees allocated resources.
    
    Committer node:
    
    Added similar fix to raid5.c, as suggested by Guoqing.
    
    Cc: stable@vger.kernel.org # v3.16+
    Acked-by: Guoqing Jiang <gqjiang@suse.com>
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Signed-off-by: Song Liu <songliubraving@fb.com>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index ecef42bfe19d..3b6880dd648d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3939,6 +3939,8 @@ static int raid10_run(struct mddev *mddev)
 		set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
 		mddev->sync_thread = md_register_thread(md_do_sync, mddev,
 							"reshape");
+		if (!mddev->sync_thread)
+			goto out_free_conf;
 	}
 
 	return 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 09562d7cc080..992fd08437d8 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7403,6 +7403,8 @@ static int raid5_run(struct mddev *mddev)
 		set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
 		mddev->sync_thread = md_register_thread(md_do_sync, mddev,
 							"reshape");
+		if (!mddev->sync_thread)
+			goto abort;
 	}
 
 	/* Ok, everything is just fine now */

<<Prev 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19[20]21 22 23 24 25 26 27 28 29 30 Next>>