[PATCH bpf-next] nfp: fix variable dereferenced before check in nfp_app_ctrl_rx_raw()

[PATCH bpf-next] nfp: fix variable dereferenced before check in nfp_app_ctrl_rx_raw()

[Jakub Kicinski]

'app' is dereferenced before used for the devlink trace point.
In case FW is buggy and sends a control message to a VF queue
we should make sure app is not NULL.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
---
 drivers/net/ethernet/netronome/nfp/nfp_app.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app.h b/drivers/net/ethernet/netronome/nfp/nfp_app.h
index ccb244cf6c30..4e1eb3395648 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_app.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_app.h
@@ -392,10 +392,11 @@ static inline void nfp_app_ctrl_rx(struct nfp_app *app, struct sk_buff *skb)
 static inline void
 nfp_app_ctrl_rx_raw(struct nfp_app *app, const void *data, unsigned int len)
 {
-	trace_devlink_hwmsg(priv_to_devlink(app->pf), true, 0, data, len);
+	if (!app || !app->type->ctrl_msg_rx_raw)
+		return;
 
-	if (app && app->type->ctrl_msg_rx_raw)
-		app->type->ctrl_msg_rx_raw(app, data, len);
+	trace_devlink_hwmsg(priv_to_devlink(app->pf), true, 0, data, len);
+	app->type->ctrl_msg_rx_raw(app, data, len);
 }
 
 static inline int nfp_app_eswitch_mode_get(struct nfp_app *app, u16 *mode)
-- 
2.17.1

Re: [PATCH bpf-next] nfp: fix variable dereferenced before check in nfp_app_ctrl_rx_raw()

[Daniel Borkmann]

On 07/31/2018 05:33 AM, Jakub Kicinski wrote:
> 'app' is dereferenced before used for the devlink trace point.
> In case FW is buggy and sends a control message to a VF queue
> we should make sure app is not NULL.
> 
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
> Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>

Applied to bpf-next, thanks Jakub!