diff options
| author | Colin Ian King <colin.king@canonical.com> | 2017-09-22 18:13:48 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-11-21 09:27:41 +0100 |
| commit | 5637fad6b1462945ccc8bd9734146c93422590fd (patch) | |
| tree | 51fe31ea6289df4a1ba1a2fe99966c99507e131f | |
| parent | 6f0cb0e3ec883d19e89800200fe7a24240b0b0b8 (diff) | |
| download | linux-stable-5637fad6b1462945ccc8bd9734146c93422590fd.tar.gz linux-stable-5637fad6b1462945ccc8bd9734146c93422590fd.tar.bz2 linux-stable-5637fad6b1462945ccc8bd9734146c93422590fd.zip | |
e1000: avoid null pointer dereference on invalid stat type
[ Upstream commit 5983587c8c5ef00d6886477544ad67d495bc5479 ]
Currently if the stat type is invalid then data[i] is being set
either by dereferencing a null pointer p, or it is reading from
an incorrect previous location if we had a valid stat type
previously. Fix this by skipping over the read of p on an invalid
stat type.
Detected by CoverityScan, CID#113385 ("Explicit null dereferenced")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Alexander Duyck <alexander.h.duyck@intel.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c index 5ae8874bbf72..d70b2e5d5222 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c @@ -1826,11 +1826,12 @@ static void e1000_get_ethtool_stats(struct net_device *netdev, { struct e1000_adapter *adapter = netdev_priv(netdev); int i; - char *p = NULL; const struct e1000_stats *stat = e1000_gstrings_stats; e1000_update_stats(adapter); - for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++) { + for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++, stat++) { + char *p; + switch (stat->type) { case NETDEV_STATS: p = (char *)netdev + stat->stat_offset; @@ -1841,15 +1842,13 @@ static void e1000_get_ethtool_stats(struct net_device *netdev, default: WARN_ONCE(1, "Invalid E1000 stat type: %u index %d\n", stat->type, i); - break; + continue; } if (stat->sizeof_stat == sizeof(u64)) data[i] = *(u64 *)p; else data[i] = *(u32 *)p; - - stat++; } /* BUG_ON(i != E1000_STATS_LEN); */ } |