If uhdlc_priv_tsa != 1 then utdm is not initialized.
  And if ret != NULL then goto undo_uhdlc_init, where
  utdm is dereferenced. Same if dev == NULL.

  Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Esina Ekaterina <eesina@astralinux.ru>
  ---
  v3: Remove braces
  v2: Add check for NULL for unmap_si_regs
---
 drivers/net/wan/fsl_ucc_hdlc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 22edea6ca4b8..8166708c7190 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -1243,9 +1243,11 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
 free_dev:
 	free_netdev(dev);
 undo_uhdlc_init:
-	iounmap(utdm->siram);
+	if (utdm != NULL)
+		iounmap(utdm->siram);
 unmap_si_regs:
-	iounmap(utdm->si_regs);
+	if (utdm != NULL)
+		iounmap(utdm->si_regs);
 free_utdm:
 	if (uhdlc_priv->tsa)
 		kfree(utdm);
-- 
2.39.0

On Wed, 11 Jan 2023 12:05:03 +0300 Esina Ekaterina wrote:
> Subject: [PATCH v3]   net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs

net: wan: prevent null-deref on error path for non-tdm case

>   If uhdlc_priv_tsa != 1 then utdm is not initialized.
>   And if ret != NULL then goto undo_uhdlc_init, where
>   utdm is dereferenced. Same if dev == NULL.
> 
>   Found by Linux Verification Center (linuxtesting.org) with SVACE.

I did the indentation to make the content stand out in the email, 
there should be no indentation in the actual msg, sorry.

> --- a/drivers/net/wan/fsl_ucc_hdlc.c
> +++ b/drivers/net/wan/fsl_ucc_hdlc.c
> @@ -1243,9 +1243,11 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
>  free_dev:
>  	free_netdev(dev);
>  undo_uhdlc_init:
> -	iounmap(utdm->siram);
> +	if (utdm != NULL)

and here just:

	if (utdm)

comparing to NULL or zero is less idiomatic in kernel C.

> +		iounmap(utdm->siram);
>  unmap_si_regs:
> -	iounmap(utdm->si_regs);
> +	if (utdm != NULL)
> +		iounmap(utdm->si_regs);

If uhdlc_priv_tsa != 1 then utdm is not initialized.
And if ret != NULL then goto undo_uhdlc_init, where
utdm is dereferenced. Same if dev == NULL.

Found by Astra Linux on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Signed-off-by: Esina Ekaterina <eesina@astralinux.ru>
  ---
v4: Fix style
v3: Remove braces
v2: Add check for NULL for unmap_si_regs
---
 drivers/net/wan/fsl_ucc_hdlc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 22edea6ca4b8..1c53b5546927 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -1243,9 +1243,11 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
 free_dev:
 	free_netdev(dev);
 undo_uhdlc_init:
-	iounmap(utdm->siram);
+	if (utdm)
+		iounmap(utdm->siram);
 unmap_si_regs:
-	iounmap(utdm->si_regs);
+	if (utdm)
+		iounmap(utdm->si_regs);
 free_utdm:
 	if (uhdlc_priv->tsa)
 		kfree(utdm);
-- 
2.39.0

On Wed, Jan 11, 2023 at 10:55:33PM +0300, Esina Ekaterina wrote:
> If uhdlc_priv_tsa != 1 then utdm is not initialized.
> And if ret != NULL then goto undo_uhdlc_init, where
> utdm is dereferenced. Same if dev == NULL.
> 
> Found by Astra Linux on behalf of Linux Verification Center
> (linuxtesting.org) with SVACE.
> 
> Signed-off-by: Esina Ekaterina <eesina@astralinux.ru>
>   ---
> v4: Fix style
> v3: Remove braces
> v2: Add check for NULL for unmap_si_regs
> ---
>  drivers/net/wan/fsl_ucc_hdlc.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

In addition to what Jakub said, please don't send patches as reply-to.
Please sent them as new threads.

Thanks

On Wed, 11 Jan 2023 22:55:33 +0300 Esina Ekaterina wrote:
> Signed-off-by: Esina Ekaterina <eesina@astralinux.ru>
>   ---

This --- is still indented.

On top of that please tag the patch for the tree to which networking
maintainers apply fixes (by specifying [PATCH net v5] instead just
[PATCH v5] in the subject).

And add a Fixes tag. If the bug dates all the way back to the start of
the git era add:

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

otherwise use the commit which added the buggy code.