* [PATCH net v2] liquidio: Fix potential null pointer dereference
@ 2024-03-22 19:57 Aleksandr Mishin
2024-03-22 22:43 ` Jakub Kicinski
0 siblings, 1 reply; 2+ messages in thread
From: Aleksandr Mishin @ 2024-03-22 19:57 UTC (permalink / raw)
To: David S. Miller
Cc: Aleksandr Mishin, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Kees Cook, Justin Stitt, Felix Manlunas, Satanand Burla,
Raghu Vatsavayi, Vijaya Mohan Guvva, netdev, linux-kernel,
lvc-project
In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
but then it is unconditionally passed to skb_add_rx_frag() which could
lead to null pointer dereference.
Fix this bug by moving skb_add_rx_frag() into conditional scope.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
---
v2: Fix incorrect 'Fixes' tag format
drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
index aa6c0dfb6f1c..e26b4ed33dc8 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
@@ -272,13 +272,12 @@ lio_vf_rep_copy_packet(struct octeon_device *oct,
pg_info->page_offset;
memcpy(skb->data, va, MIN_SKB_SIZE);
skb_put(skb, MIN_SKB_SIZE);
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ pg_info->page,
+ pg_info->page_offset + MIN_SKB_SIZE,
+ len - MIN_SKB_SIZE,
+ LIO_RXBUFFER_SZ);
}
-
- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
- pg_info->page,
- pg_info->page_offset + MIN_SKB_SIZE,
- len - MIN_SKB_SIZE,
- LIO_RXBUFFER_SZ);
} else {
struct octeon_skb_page_info *pg_info =
((struct octeon_skb_page_info *)(skb->cb));
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net v2] liquidio: Fix potential null pointer dereference
2024-03-22 19:57 [PATCH net v2] liquidio: Fix potential null pointer dereference Aleksandr Mishin
@ 2024-03-22 22:43 ` Jakub Kicinski
0 siblings, 0 replies; 2+ messages in thread
From: Jakub Kicinski @ 2024-03-22 22:43 UTC (permalink / raw)
To: Aleksandr Mishin
Cc: David S. Miller, Eric Dumazet, Paolo Abeni, Kees Cook,
Justin Stitt, Felix Manlunas, Satanand Burla, Raghu Vatsavayi,
Vijaya Mohan Guvva, netdev, linux-kernel, lvc-project
On Fri, 22 Mar 2024 22:57:44 +0300 Aleksandr Mishin wrote:
> In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
> but then it is unconditionally passed to skb_add_rx_frag() which could
> lead to null pointer dereference.
> Fix this bug by moving skb_add_rx_frag() into conditional scope.
The explanation should tell us how the bug can happen, i.e. what
sequence of events leads to null-deref. Not what logic your tool
matched on, perhaps the NULL check is unnecessary.
--
pw-bot: cr
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-03-22 22:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-03-22 19:57 [PATCH net v2] liquidio: Fix potential null pointer dereference Aleksandr Mishin
2024-03-22 22:43 ` Jakub Kicinski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.