* [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator
@ 2022-03-27 7:35 Xiaomeng Tong
2022-03-27 16:38 ` Leon Romanovsky
0 siblings, 1 reply; 4+ messages in thread
From: Xiaomeng Tong @ 2022-03-27 7:35 UTC (permalink / raw)
To: bharat, jgg
Cc: vipul, roland, linux-rdma, linux-kernel, Xiaomeng Tong, stable
The bug is here:
if (!pdev) {
The list iterator value 'pdev' will *always* be set and non-NULL
by for_each_netdev(), so it is incorrect to assume that the
iterator value will be NULL if the list is empty or no element
found (in this case, the check 'if (!pdev)' can be bypassed as
it always be false unexpectly).
To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'pdev' as a dedicated pointer to
point to the found element.
Cc: stable@vger.kernel.org
Fixes: 830662f6f032f ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
---
drivers/infiniband/hw/cxgb4/cm.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index c16017f6e8db..870d8517310b 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2071,7 +2071,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
{
struct neighbour *n;
int err, step;
- struct net_device *pdev;
+ struct net_device *pdev = NULL, *iter;
n = dst_neigh_lookup(dst, peer_ip);
if (!n)
@@ -2083,14 +2083,14 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
if (iptype == 4)
pdev = ip_dev_find(&init_net, *(__be32 *)peer_ip);
else if (IS_ENABLED(CONFIG_IPV6))
- for_each_netdev(&init_net, pdev) {
+ for_each_netdev(&init_net, iter) {
if (ipv6_chk_addr(&init_net,
(struct in6_addr *)peer_ip,
- pdev, 1))
+ iter, 1)) {
+ pdev = iter;
break;
+ }
}
- else
- pdev = NULL;
if (!pdev) {
err = -ENODEV;
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator
2022-03-27 7:35 [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator Xiaomeng Tong
@ 2022-03-27 16:38 ` Leon Romanovsky
2022-03-30 12:30 ` Xiaomeng Tong
0 siblings, 1 reply; 4+ messages in thread
From: Leon Romanovsky @ 2022-03-27 16:38 UTC (permalink / raw)
To: Xiaomeng Tong
Cc: bharat, jgg, vipul, roland, linux-rdma, linux-kernel, stable
On Sun, Mar 27, 2022 at 03:35:42PM +0800, Xiaomeng Tong wrote:
> The bug is here:
> if (!pdev) {
>
> The list iterator value 'pdev' will *always* be set and non-NULL
> by for_each_netdev(), so it is incorrect to assume that the
> iterator value will be NULL if the list is empty or no element
> found (in this case, the check 'if (!pdev)' can be bypassed as
> it always be false unexpectly).
>
> To fix the bug, use a new variable 'iter' as the list iterator,
> while use the original variable 'pdev' as a dedicated pointer to
> point to the found element.
I don't think that the description is correct.
We are talking about loopback interface which received packet, the pdev will always exist.
Most likely. the check of "if (!pdev)" is to catch impossible situation where IPV6 packet
was sent over loopback, but IPV6 is not enabled.
Thanks
>
> Cc: stable@vger.kernel.org
> Fixes: 830662f6f032f ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
> Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
> ---
> drivers/infiniband/hw/cxgb4/cm.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
> index c16017f6e8db..870d8517310b 100644
> --- a/drivers/infiniband/hw/cxgb4/cm.c
> +++ b/drivers/infiniband/hw/cxgb4/cm.c
> @@ -2071,7 +2071,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
> {
> struct neighbour *n;
> int err, step;
> - struct net_device *pdev;
> + struct net_device *pdev = NULL, *iter;
>
> n = dst_neigh_lookup(dst, peer_ip);
> if (!n)
> @@ -2083,14 +2083,14 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
> if (iptype == 4)
> pdev = ip_dev_find(&init_net, *(__be32 *)peer_ip);
> else if (IS_ENABLED(CONFIG_IPV6))
> - for_each_netdev(&init_net, pdev) {
> + for_each_netdev(&init_net, iter) {
> if (ipv6_chk_addr(&init_net,
> (struct in6_addr *)peer_ip,
> - pdev, 1))
> + iter, 1)) {
> + pdev = iter;
> break;
> + }
> }
> - else
> - pdev = NULL;
>
> if (!pdev) {
> err = -ENODEV;
> --
> 2.17.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator
2022-03-27 16:38 ` Leon Romanovsky
@ 2022-03-30 12:30 ` Xiaomeng Tong
2022-03-30 12:53 ` Leon Romanovsky
0 siblings, 1 reply; 4+ messages in thread
From: Xiaomeng Tong @ 2022-03-30 12:30 UTC (permalink / raw)
To: leon
Cc: bharat, jgg, linux-kernel, linux-rdma, roland, stable, vipul,
xiam0nd.tong
On Sun, 27 Mar 2022 19:38:31 +0300, Leon Romanovsky wrote:
>
> On Sun, Mar 27, 2022 at 03:35:42PM +0800, Xiaomeng Tong wrote:
> > The bug is here:
> > if (!pdev) {
> >
> > The list iterator value 'pdev' will *always* be set and non-NULL
> > by for_each_netdev(), so it is incorrect to assume that the
> > iterator value will be NULL if the list is empty or no element
> > found (in this case, the check 'if (!pdev)' can be bypassed as
> > it always be false unexpectly).
> >
> > To fix the bug, use a new variable 'iter' as the list iterator,
> > while use the original variable 'pdev' as a dedicated pointer to
> > point to the found element.
>
> I don't think that the description is correct.
> We are talking about loopback interface which received packet, the pdev will always exist.
Do the both conditions impossible?
1. the list is empty or
2. we can not found a pdev due to this check
if (ipv6_chk_addr(&init_net,
(struct in6_addr *)peer_ip,
pdev, 1))
iter, 1))
> Most likely. the check of "if (!pdev)" is to catch impossible situation where IPV6 packet
> was sent over loopback, but IPV6 is not enabled.
--
Xiaomeng Tong
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator
2022-03-30 12:30 ` Xiaomeng Tong
@ 2022-03-30 12:53 ` Leon Romanovsky
0 siblings, 0 replies; 4+ messages in thread
From: Leon Romanovsky @ 2022-03-30 12:53 UTC (permalink / raw)
To: Xiaomeng Tong
Cc: bharat, jgg, linux-kernel, linux-rdma, roland, stable, vipul
On Wed, Mar 30, 2022 at 08:30:27PM +0800, Xiaomeng Tong wrote:
> On Sun, 27 Mar 2022 19:38:31 +0300, Leon Romanovsky wrote:
> >
> > On Sun, Mar 27, 2022 at 03:35:42PM +0800, Xiaomeng Tong wrote:
> > > The bug is here:
> > > if (!pdev) {
> > >
> > > The list iterator value 'pdev' will *always* be set and non-NULL
> > > by for_each_netdev(), so it is incorrect to assume that the
> > > iterator value will be NULL if the list is empty or no element
> > > found (in this case, the check 'if (!pdev)' can be bypassed as
> > > it always be false unexpectly).
> > >
> > > To fix the bug, use a new variable 'iter' as the list iterator,
> > > while use the original variable 'pdev' as a dedicated pointer to
> > > point to the found element.
> >
> > I don't think that the description is correct.
> > We are talking about loopback interface which received packet, the pdev will always exist.
>
> Do the both conditions impossible?
> 1. the list is empty or
> 2. we can not found a pdev due to this check
> if (ipv6_chk_addr(&init_net,
> (struct in6_addr *)peer_ip,
> pdev, 1))
> iter, 1))
Yes, both are impossible.
Thanks
>
> > Most likely. the check of "if (!pdev)" is to catch impossible situation where IPV6 packet
> > was sent over loopback, but IPV6 is not enabled.
>
> --
> Xiaomeng Tong
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-03-30 12:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-27 7:35 [PATCH] cxgb4: cm: fix a incorrect NULL check on list iterator Xiaomeng Tong
2022-03-27 16:38 ` Leon Romanovsky
2022-03-30 12:30 ` Xiaomeng Tong
2022-03-30 12:53 ` Leon Romanovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).