| Message ID | 20250131121450.11645-1-piotr.kwapulinski@intel.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [iwl-next,v4] ixgbe: Fix possible skb NULL pointer dereference | expand |
On Fri, Jan 31, 2025 at 01:14:50PM +0100, Piotr Kwapulinski wrote: > The commit c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in > ixgbe_run_xdp()") stopped utilizing the ERR-like macros for xdp status > encoding. Propagate this logic to the ixgbe_put_rx_buffer(). > > The commit also relaxed the skb NULL pointer check - caught by Smatch. > Restore this check. > > Fixes: c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> > Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> > --- > v1 -> v2 > Provide extra details in commit message for motivation of this patch > v2 -> v3 > Simplify the check condition > v3 -> v4 > Rebase to net-queue Reviewed-by: Simon Horman <horms@kernel.org>
On Fri, Jan 31, 2025 at 01:14:50PM +0100, Piotr Kwapulinski wrote: > The commit c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in > ixgbe_run_xdp()") stopped utilizing the ERR-like macros for xdp status > encoding. Propagate this logic to the ixgbe_put_rx_buffer(). > > The commit also relaxed the skb NULL pointer check - caught by Smatch. > Restore this check. > > Fixes: c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> > Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> Reviewed-by: Simon Horman <horms@kernel.org>
On 1/31/2025 4:14 AM, Piotr Kwapulinski wrote: > The commit c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in > ixgbe_run_xdp()") stopped utilizing the ERR-like macros for xdp status > encoding. Propagate this logic to the ixgbe_put_rx_buffer(). > > The commit also relaxed the skb NULL pointer check - caught by Smatch. > Restore this check. > > Fixes: c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> > Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> > --- > v1 -> v2 > Provide extra details in commit message for motivation of this patch > v2 -> v3 > Simplify the check condition > v3 -> v4 > Rebase to net-queue Applied to net-queue; the target tree should have been updated as well (iwl-net). I'm also adding in the Closes: for the report. Closes: https://lore.kernel.org/intel-wired-lan/2c7d6c31-192a-4047-bd90-9566d0e14cc0@stanley.mountain/ Thanks, Tony > --- > drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > index 7236f20..467f812 100644 > --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > @@ -2105,7 +2105,7 @@ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, > /* hand second half of page back to the ring */ > ixgbe_reuse_rx_page(rx_ring, rx_buffer); > } else { > - if (!IS_ERR(skb) && IXGBE_CB(skb)->dma == rx_buffer->dma) { > + if (skb && IXGBE_CB(skb)->dma == rx_buffer->dma) { > /* the page has been released from the ring */ > IXGBE_CB(skb)->page_released = true; > } else {
> -----Original Message----- > From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of > Kwapulinski, Piotr > Sent: 31 January 2025 17:45 > To: intel-wired-lan@lists.osuosl.org > Cc: netdev@vger.kernel.org; dan.carpenter@linaro.org; > yuehaibing@huawei.com; Fijalkowski, Maciej <maciej.fijalkowski@intel.com>; > Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; Kwapulinski, Piotr > <piotr.kwapulinski@intel.com> > Subject: [Intel-wired-lan] [PATCH iwl-next v4] ixgbe: Fix possible skb NULL > pointer dereference > > The commit c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in > ixgbe_run_xdp()") stopped utilizing the ERR-like macros for xdp status > encoding. Propagate this logic to the ixgbe_put_rx_buffer(). > > The commit also relaxed the skb NULL pointer check - caught by Smatch. > Restore this check. > > Fixes: c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> > Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> > --- > v1 -> v2 > Provide extra details in commit message for motivation of this patch > v2 -> v3 > Simplify the check condition > v3 -> v4 > Rebase to net-queue > --- > drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > Tested-by: Saritha Sanigani <sarithax.sanigani@intel.com> (A Contingent Worker at Intel)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c index 7236f20..467f812 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c @@ -2105,7 +2105,7 @@ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, /* hand second half of page back to the ring */ ixgbe_reuse_rx_page(rx_ring, rx_buffer); } else { - if (!IS_ERR(skb) && IXGBE_CB(skb)->dma == rx_buffer->dma) { + if (skb && IXGBE_CB(skb)->dma == rx_buffer->dma) { /* the page has been released from the ring */ IXGBE_CB(skb)->page_released = true; } else {
The commit c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") stopped utilizing the ERR-like macros for xdp status encoding. Propagate this logic to the ixgbe_put_rx_buffer(). The commit also relaxed the skb NULL pointer check - caught by Smatch. Restore this check. Fixes: c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> --- v1 -> v2 Provide extra details in commit message for motivation of this patch v2 -> v3 Simplify the check condition v3 -> v4 Rebase to net-queue --- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)