* [PATCH net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
@ 2023-04-17 12:07 Nikita Zhandarovich
2023-04-18 6:15 ` Ido Schimmel
2023-04-18 14:00 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Nikita Zhandarovich @ 2023-04-17 12:07 UTC (permalink / raw)
To: mlxsw
Cc: Nikita Zhandarovich, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, netdev, linux-kernel, lvc-project,
Natalia Petrova
Function mlxfw_mfa2_tlv_multi_get() returns NULL if 'tlv' in
question does not pass checks in mlxfw_mfa2_tlv_payload_get(). This
behaviour may lead to NULL pointer dereference in 'multi->total_len'.
Fix this issue by testing mlxfw_mfa2_tlv_multi_get()'s return value
against NULL.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process")
Co-developed-by: Natalia Petrova <n.petrova@fintech.ru>
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
---
drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c
index 017d68f1e123..972c571b4158 100644
--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c
+++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c
@@ -31,6 +31,8 @@ mlxfw_mfa2_tlv_next(const struct mlxfw_mfa2_file *mfa2_file,
if (tlv->type == MLXFW_MFA2_TLV_MULTI_PART) {
multi = mlxfw_mfa2_tlv_multi_get(mfa2_file, tlv);
+ if (!multi)
+ return NULL;
tlv_len = NLA_ALIGN(tlv_len + be16_to_cpu(multi->total_len));
}
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
2023-04-17 12:07 [PATCH net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() Nikita Zhandarovich
@ 2023-04-18 6:15 ` Ido Schimmel
2023-04-18 14:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Ido Schimmel @ 2023-04-18 6:15 UTC (permalink / raw)
To: Nikita Zhandarovich
Cc: mlxsw, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, linux-kernel, lvc-project, Natalia Petrova
On Mon, Apr 17, 2023 at 05:07:18AM -0700, Nikita Zhandarovich wrote:
> Function mlxfw_mfa2_tlv_multi_get() returns NULL if 'tlv' in
> question does not pass checks in mlxfw_mfa2_tlv_payload_get(). This
> behaviour may lead to NULL pointer dereference in 'multi->total_len'.
> Fix this issue by testing mlxfw_mfa2_tlv_multi_get()'s return value
> against NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
>
> Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process")
> Co-developed-by: Natalia Petrova <n.petrova@fintech.ru>
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
2023-04-17 12:07 [PATCH net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() Nikita Zhandarovich
2023-04-18 6:15 ` Ido Schimmel
@ 2023-04-18 14:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-04-18 14:00 UTC (permalink / raw)
To: Nikita Zhandarovich
Cc: mlxsw, davem, edumazet, kuba, pabeni, netdev, linux-kernel,
lvc-project, n.petrova
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Mon, 17 Apr 2023 05:07:18 -0700 you wrote:
> Function mlxfw_mfa2_tlv_multi_get() returns NULL if 'tlv' in
> question does not pass checks in mlxfw_mfa2_tlv_payload_get(). This
> behaviour may lead to NULL pointer dereference in 'multi->total_len'.
> Fix this issue by testing mlxfw_mfa2_tlv_multi_get()'s return value
> against NULL.
>
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
>
> [...]
Here is the summary with links:
- [net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
https://git.kernel.org/netdev/net/c/c0e73276f0fc
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-04-18 14:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-04-17 12:07 [PATCH net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() Nikita Zhandarovich
2023-04-18 6:15 ` Ido Schimmel
2023-04-18 14:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).