bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Simon Horman <horms@kernel.org>
To: Jesse Brandeburg <jesse.brandeburg@intel.com>,
	 Tony Nguyen <anthony.l.nguyen@intel.com>
Cc: Alexei Starovoitov <ast@kernel.org>,
	 Andre Guedes <andre.guedes@intel.com>,
	 Dan Carpenter <dan.carpenter@linaro.org>,
	 Daniel Borkmann <daniel@iogearbox.net>,
	 "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	 Florian Kauer <florian.kauer@linutronix.de>,
	 Jakub Kicinski <kuba@kernel.org>,
	Jesper Dangaard Brouer <hawk@kernel.org>,
	 Jithu Joseph <jithu.joseph@intel.com>,
	 John Fastabend <john.fastabend@gmail.com>,
	 Maciej Fijalkowski <maciej.fijalkowski@intel.com>,
	 Paolo Abeni <pabeni@redhat.com>,
	Vedang Patel <vedang.patel@intel.com>,
	 intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
	 bpf@vger.kernel.org
Subject: [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx_irq()
Date: Thu, 15 Jun 2023 11:45:36 +0200	[thread overview]
Message-ID: <20230615-igc-err-ptr-v1-1-a17145eb8d62@kernel.org> (raw)

In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned
to the skb local variable. This may be an ERR_PTR.

A little later the following is executed, which seems to be a
possible dereference of an ERR_PTR.

	total_bytes += skb->len;

Avoid this problem by continuing the loop in which all of the
above occurs once the handling of the NULL case completes.

This proposed fix is speculative - I do not have deep knowledge of this
driver.  And I am concerned about the effect of skipping the following
logic:

  igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
  cleaned_count++;

Flagged by Smatch as:

  .../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR'

Compile tested only.

Fixes: 26575105d6ed ("igc: Add initial XDP support")
Signed-off-by: Simon Horman <horms@kernel.org>
---
 drivers/net/ethernet/intel/igc/igc_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 88145c30c919..b58c8a674bd1 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -2586,6 +2586,7 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
 
 			total_packets++;
 			total_bytes += size;
+			continue;
 		} else if (skb)
 			igc_add_rx_frag(rx_ring, rx_buffer, skb, size);
 		else if (ring_uses_build_skb(rx_ring))


             reply	other threads:[~2023-06-15  9:45 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-06-15  9:45 Simon Horman [this message]
2023-06-15  9:55 ` [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx_irq() Maciej Fijalkowski
2023-06-15 11:27   ` Simon Horman
2023-06-15 12:09     ` Maciej Fijalkowski
2023-06-15 14:14       ` Simon Horman
2023-06-15 14:25 ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230615-igc-err-ptr-v1-1-a17145eb8d62@kernel.org \
    --to=horms@kernel.org \
    --cc=andre.guedes@intel.com \
    --cc=anthony.l.nguyen@intel.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=dan.carpenter@linaro.org \
    --cc=daniel@iogearbox.net \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=florian.kauer@linutronix.de \
    --cc=hawk@kernel.org \
    --cc=intel-wired-lan@lists.osuosl.org \
    --cc=jesse.brandeburg@intel.com \
    --cc=jithu.joseph@intel.com \
    --cc=john.fastabend@gmail.com \
    --cc=kuba@kernel.org \
    --cc=maciej.fijalkowski@intel.com \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=vedang.patel@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).