[lvc-project] [PATCH] be2net: Remove potential access to the zero address

Ваторопин Андрей a.vatoropin at crpt.ru
Wed Apr 16 13:55:47 MSK 2025


From: Andrey Vatoropin <a.vatoropin at crpt.ru>

At the moment of calling the function be_cmd_get_mac_from_list() with the
following parameters:
be_cmd_get_mac_from_list(adapter, mac, &pmac_valid, NULL, 
					adapter->if_handle, 0);

The parameter "pmac_id" equals NULL.

Then, if "mac_addr_size" equals four bytes, there is a possibility of
accessing the zero address via the pointer "pmac_id".

Add an extra check for the pointer "pmac_id" to avoid accessing the zero
address.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
       
Fixes: e5e1ee894615 ("be2net: Use new implementation of get mac list command")
Signed-off-by: Andrey Vatoropin <a.vatoropin at crpt.ru>
---
 drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 51b8377edd1d..be5bbf6881b8 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -3757,7 +3757,7 @@ int be_cmd_get_mac_from_list(struct be_adapter *adapter, u8 *mac,
 			/* mac_id is a 32 bit value and mac_addr size
 			 * is 6 bytes
 			 */
-			if (mac_addr_size == sizeof(u32)) {
+			if (pmac_id && mac_addr_size == sizeof(u32)) {
 				*pmac_id_valid = true;
 				mac_id = mac_entry->mac_addr_id.s_mac_id.mac_id;
 				*pmac_id = le32_to_cpu(mac_id);
-- 
2.43.0



More information about the lvc-project mailing list