Mirrors_Framework/nuttx
1
0
Fork 0
mirror of https://github.com/apache/nuttx.git synced 2025-12-12 13:55:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

mpfs_ethernet.c: Fix possible NULL de-reference

Browse Source 
Fix case where NULL is de-referenced via tx/rx buffer or descriptor. Only
1 queue is currently set up for each, so the indices 1,2,3 are not valid
and should not be handled.
This commit is contained in:
Ville Juven
2023-10-16 13:18:03 +03:00
committed by Xiang Xiao
parent ee985d8d10
commit cc423c4c0f
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
arch/risc-v/src/mpfs/mpfs_ethernet.c
View File

@@ -1180,6 +1180,13 @@ static void mpfs_txreset(struct mpfs_ethmac_s *priv)
priv->queue[qi].txhead = 0; priv->queue[qi].txhead = 0;
priv->queue[qi].txtail = 0; priv->queue[qi].txtail = 0;
if (!txdesc || !txbuffer)
{
/* The queue index is not set up */
continue;
}
for (ndx = 0; ndx < CONFIG_MPFS_ETHMAC_NTXBUFFERS; ndx++) for (ndx = 0; ndx < CONFIG_MPFS_ETHMAC_NTXBUFFERS; ndx++)
{ {
bufaddr = (uintptr_t)&txbuffer[ndx * GMAC_TX_UNITSIZE]; bufaddr = (uintptr_t)&txbuffer[ndx * GMAC_TX_UNITSIZE];
@@ -1255,6 +1262,13 @@ static void mpfs_rxreset(struct mpfs_ethmac_s *priv)
rxdesc = priv->queue[qi].rx_desc_tab; rxdesc = priv->queue[qi].rx_desc_tab;
priv->queue[qi].rxndx = 0; priv->queue[qi].rxndx = 0;
if (!rxdesc || !rxbuffer)
{
/* The queue index is not set up */
continue;
}
for (ndx = 0; ndx < CONFIG_MPFS_ETHMAC_NRXBUFFERS; ndx++) for (ndx = 0; ndx < CONFIG_MPFS_ETHMAC_NRXBUFFERS; ndx++)
{ {
bufaddr = (uintptr_t)&rxbuffer[ndx * GMAC_RX_UNITSIZE]; bufaddr = (uintptr_t)&rxbuffer[ndx * GMAC_RX_UNITSIZE];