During a probe failure, the e1000 driver error handling path calls iounmap() on hw->ce4100_gbe_mdio_base_virt and hw->hw_addr without checking if they were previously mapped. This triggers a kernel warning (WARN) rather than a fatal crash when passed an uninitialized pointer.
This issue was found by Syzbot. The exact kernel configuration (.config) and the C reproducer used to trigger this warning are available on the Syzbot dashboard. Fix this by adding NULL checks before calling iounmap(). Reported-by: [email protected] Fixes: 13acde8fffc0a ("e1000: cleanup CE4100 MDIO registers access") Fixes: 1dc329180fe22 ("e1000: Use hw, er32, and ew32") Reviewed-by: Aleksandr Loktionov <[email protected]> Signed-off-by: Svyatoslav Nikolenko <[email protected]> --- v2: - Expanded commit message to answer reviewer questions (reproduction details) - Added appropriate Fixes tags - Added Reviewed-by tag from Aleksandr Loktionov drivers/net/ethernet/intel/e1000/e1000_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index d7f5c6f16142..156903089fa6 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -1227,8 +1227,10 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) kfree(adapter->rx_ring); err_dma: err_sw_init: - iounmap(hw->ce4100_gbe_mdio_base_virt); - iounmap(hw->hw_addr); + if (hw->ce4100_gbe_mdio_base_virt) + iounmap(hw->ce4100_gbe_mdio_base_virt); + if (hw->hw_addr) + iounmap(hw->hw_addr); err_ioremap: disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); free_netdev(netdev); -- 2.47.3
