[PATCH net] sfc: fix null pointer dereference in efx_hard_start_xmit

[PATCH net] sfc: fix null pointer dereference in efx_hard_start_xmit

[Íñigo Huguet]

Trying to get the channel from the tx_queue variable here is wrong
because we can only be here if tx_queue is NULL, so we shouldn't
dereference it. As the above comment in the code says, this is very
unlikely to happen, but it's wrong anyway so let's fix it.

I hit this issue because of a different bug that caused tx_queue to be
NULL. If that happens, this is the error message that we get here:
  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
  [...]
  RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]

Fixes: 12804793b17c ("sfc: decouple TXQ type from label")
Reported-by: Tianhao Zhao <tizhao@redhat.com>
Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>
---
 drivers/net/ethernet/sfc/tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index d12474042c84..c5f88f7a7a04 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -549,7 +549,7 @@ netdev_tx_t efx_hard_start_xmit(struct sk_buff *skb,
 		 * previous packets out.
 		 */
 		if (!netdev_xmit_more())
-			efx_tx_send_pending(tx_queue->channel);
+			efx_tx_send_pending(efx_get_tx_channel(efx, index));
 		return NETDEV_TX_OK;
 	}
 
-- 
2.34.1

Re: [PATCH net] sfc: fix null pointer dereference in efx_hard_start_xmit

[Edward Cree]

On 14/09/2022 12:11, Íñigo Huguet wrote:
> Trying to get the channel from the tx_queue variable here is wrong
> because we can only be here if tx_queue is NULL, so we shouldn't
> dereference it. As the above comment in the code says, this is very
> unlikely to happen, but it's wrong anyway so let's fix it.
> 
> I hit this issue because of a different bug that caused tx_queue to be
> NULL. If that happens, this is the error message that we get here:
>   BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
>   [...]
>   RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]
> 
> Fixes: 12804793b17c ("sfc: decouple TXQ type from label")
> Reported-by: Tianhao Zhao <tizhao@redhat.com>
> Signed-off-by: Íñigo Huguet <ihuguet@redhat.com>

Acked-by: Edward Cree <ecree.xilinx@gmail.com>

Re: [PATCH net] sfc: fix null pointer dereference in efx_hard_start_xmit

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 14 Sep 2022 13:11:35 +0200 you wrote:
> Trying to get the channel from the tx_queue variable here is wrong
> because we can only be here if tx_queue is NULL, so we shouldn't
> dereference it. As the above comment in the code says, this is very
> unlikely to happen, but it's wrong anyway so let's fix it.
> 
> I hit this issue because of a different bug that caused tx_queue to be
> NULL. If that happens, this is the error message that we get here:
>   BUG: unable to handle kernel NULL pointer dereference at 0000000000000020
>   [...]
>   RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]
> 
> [...]

Here is the summary with links:
  - [net] sfc: fix null pointer dereference in efx_hard_start_xmit
    https://git.kernel.org/netdev/net/c/0a242eb2913a

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html