From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7635CC433DB for ; Fri, 22 Jan 2021 14:32:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3B70020731 for ; Fri, 22 Jan 2021 14:32:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728628AbhAVOcY (ORCPT ); Fri, 22 Jan 2021 09:32:24 -0500 Received: from mail.kernel.org ([198.145.29.99]:40024 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728432AbhAVOZl (ORCPT ); Fri, 22 Jan 2021 09:25:41 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id D617023B09; Fri, 22 Jan 2021 14:19:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1611325193; bh=I/9p1OzeQA0INv+403TFpmE984l0xVl+zZ/j/WXI/Pc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f3gIRJn9i7W2fS7DGfXHmkPDMbVGdQF9var43HhiNswT8khoHr4K7UK8ZuWgnJDoJ PdRN64R7gwr1bZzuxT/iIlqLEWNVc+uC3rvt1KtCiYtIDra1ZKdIdxxYNkF3ma+moa wCEEISJ4Tfcn0f9/RJCJo+kuY3WYugwIKdz1kmyE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Cristian Dumitrescu , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Jakub Kicinski Subject: [PATCH 5.10 25/43] i40e: fix potential NULL pointer dereferencing Date: Fri, 22 Jan 2021 15:12:41 +0100 Message-Id: <20210122135736.666730336@linuxfoundation.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210122135735.652681690@linuxfoundation.org> References: <20210122135735.652681690@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Cristian Dumitrescu [ Upstream commit 7128c834d30e6b2cf649f14d8fc274941786d0e1 ] Currently, the function i40e_construct_skb_zc only frees the input xdp buffer when the output skb is successfully built. On error, the function i40e_clean_rx_irq_zc does not commit anything for the current packet descriptor and simply exits the packet descriptor processing loop, with the plan to restart the processing of this descriptor on the next invocation. Therefore, on error the ring next-to-clean pointer should not advance, the xdp i.e. *bi buffer should not be freed and the current buffer info should not be invalidated by setting *bi to NULL. Therefore, the *bi should only be set to NULL when the function i40e_construct_skb_zc is successful, otherwise a NULL *bi will be dereferenced when the work for the current descriptor is eventually restarted. Fixes: 3b4f0b66c2b3 ("i40e, xsk: Migrate to new MEM_TYPE_XSK_BUFF_POOL") Signed-off-by: Cristian Dumitrescu Acked-by: Björn Töpel Link: https://lore.kernel.org/r/20210111181138.49757-1-cristian.dumitrescu@intel.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c +++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c @@ -348,12 +348,12 @@ int i40e_clean_rx_irq_zc(struct i40e_rin * SBP is *not* set in PRT_SBPVSI (default not set). */ skb = i40e_construct_skb_zc(rx_ring, *bi); - *bi = NULL; if (!skb) { rx_ring->rx_stats.alloc_buff_failed++; break; } + *bi = NULL; cleaned_count++; i40e_inc_ntc(rx_ring);