From patchwork Tue Feb 9 20:11:15 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rasmus Villemoes X-Patchwork-Id: 581062 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id C6110140BAD for ; Wed, 10 Feb 2016 07:12:12 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=rasmusvillemoes.dk header.i=@rasmusvillemoes.dk header.b=IgzinHPH; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932888AbcBIUL4 (ORCPT ); Tue, 9 Feb 2016 15:11:56 -0500 Received: from mail-wm0-f46.google.com ([74.125.82.46]:33485 "EHLO mail-wm0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753623AbcBIULc (ORCPT ); Tue, 9 Feb 2016 15:11:32 -0500 Received: by mail-wm0-f46.google.com with SMTP id g62so142964wme.0 for ; Tue, 09 Feb 2016 12:11:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rasmusvillemoes.dk; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=WiWorqSzSsRyoMz+2D755DyOFFTG1z0Xb06Kx570vzA=; b=IgzinHPHjvZCO7JiU3HFsYTsU86LBXxqXv4R9xjsLdRJYNkCmGl99pp5UqtQwZpU64 pOQFJBPUFQ/5wI1jrY92cUSCAHER2JwuPlggQ7ul2RGQi7iRc2v1SiBDzU33BoNUnWiH eqbXR22Equj//oOaz6RkhTU4Esx5geSc+fZTI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=WiWorqSzSsRyoMz+2D755DyOFFTG1z0Xb06Kx570vzA=; b=MJgVD/jicmdK6FxnNSTPgrbpwWd7INZnK1ZZJR8ykBnK9XnBNU5pgU+kZaF6a5OX4Z WzERD6dQe1RQmzyJvAkhHmfTIv52ka8DBIX2NERPR35tIEDNVTTEA/yMu4ySKpNVfihI q+pvoXs/uUy0ucRs9Nr92K0/GrtL/XDv8GExAlElf5F9sRskwFE2qvTscJK8zBH00ajQ FWhKJg36LvxmD9aFVDyC7/Xs0o4dpQQ7NvezIRQA1Kbm4Ff67UF9ZePsDJHk8lzxZtqv RCybNtGRenl8yqSz73gMI5F7VPWelBB1Ib/5pUgPI8YZPupUzt9bV2JOE1gfa+/gnaeq nRMw== X-Gm-Message-State: AG10YOQZ/Dn0V2LCgTW42j0/A3hqvNkAnkZEP/RZPwzhvkri/Z/n4uFkQZ4NNa/FLTNZDA== X-Received: by 10.194.249.69 with SMTP id ys5mr34012113wjc.97.1455048690832; Tue, 09 Feb 2016 12:11:30 -0800 (PST) Received: from wildmoose.dk (lvps87-230-87-209.dedicated.hosteurope.de. [87.230.87.209]) by smtp.gmail.com with ESMTPSA id h14sm1384331wjs.41.2016.02.09.12.11.30 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 09 Feb 2016 12:11:30 -0800 (PST) From: Rasmus Villemoes To: Byungho An , Girish K S , Vipul Pandya Cc: Rasmus Villemoes , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 4/5] net: sxgbe: fix error paths in sxgbe_platform_probe() Date: Tue, 9 Feb 2016 21:11:15 +0100 Message-Id: <1455048677-19882-5-git-send-email-linux@rasmusvillemoes.dk> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1455048677-19882-1-git-send-email-linux@rasmusvillemoes.dk> References: <1455048677-19882-1-git-send-email-linux@rasmusvillemoes.dk> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org We need to use post-decrement to ensure that irq_dispose_mapping is also called on priv->rxq[0]->irq_no; moreover, if one of the above for loops failed already at i==0 (so we reach one of these labels with that value of i), we'll enter an essentially infinite loop of out-of-bounds accesses. Signed-off-by: Rasmus Villemoes --- drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c index b02eed12bfc5..73427e29df2a 100644 --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_platform.c @@ -155,11 +155,11 @@ static int sxgbe_platform_probe(struct platform_device *pdev) return 0; err_rx_irq_unmap: - while (--i) + while (i--) irq_dispose_mapping(priv->rxq[i]->irq_no); i = SXGBE_TX_QUEUES; err_tx_irq_unmap: - while (--i) + while (i--) irq_dispose_mapping(priv->txq[i]->irq_no); irq_dispose_mapping(priv->irq); err_drv_remove: