| Message ID | 20240924160018.29049-1-esalomatkina@ispras.ru (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | [net,v2] net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() | expand |
On Tue, Sep 24, 2024 at 07:00:18PM +0300, Elena Salomatkina wrote: > In mlx5e_tir_builder_alloc() kvzalloc() may return NULL > which is dereferenced on the next line in a reference > to the modify field. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: a6696735d694 ("net/mlx5e: Convert TIR to a dedicated object") > Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru> > --- > v2: Fix tab, add blank line Thanks for the update, this version looks good to me. Reviewed-by: Simon Horman <horms@kernel.org>
On Tue, Sep 24, 2024 at 9:31 PM Elena Salomatkina <esalomatkina@ispras.ru> wrote: > > In mlx5e_tir_builder_alloc() kvzalloc() may return NULL > which is dereferenced on the next line in a reference > to the modify field. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: a6696735d694 ("net/mlx5e: Convert TIR to a dedicated object") > Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru> LGTM Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
On 24/09/2024 19:00, Elena Salomatkina wrote: > In mlx5e_tir_builder_alloc() kvzalloc() may return NULL > which is dereferenced on the next line in a reference > to the modify field. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: a6696735d694 ("net/mlx5e: Convert TIR to a dedicated object") > Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru> > --- > v2: Fix tab, add blank line > > drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c > index d4239e3b3c88..11f724ad90db 100644 > --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c > @@ -23,6 +23,9 @@ struct mlx5e_tir_builder *mlx5e_tir_builder_alloc(bool modify) > struct mlx5e_tir_builder *builder; > > builder = kvzalloc(sizeof(*builder), GFP_KERNEL); > + if (!builder) > + return NULL; > + > builder->modify = modify; > > return builder; Thanks for your patch. Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
On 24/09/2024 19:00, Elena Salomatkina wrote: > In mlx5e_tir_builder_alloc() kvzalloc() may return NULL > which is dereferenced on the next line in a reference > to the modify field. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: a6696735d694 ("net/mlx5e: Convert TIR to a dedicated object") > Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru> Thanks! Reviewed-by: Gal Pressman <gal@nvidia.com>
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c index d4239e3b3c88..11f724ad90db 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c @@ -23,6 +23,9 @@ struct mlx5e_tir_builder *mlx5e_tir_builder_alloc(bool modify) struct mlx5e_tir_builder *builder; builder = kvzalloc(sizeof(*builder), GFP_KERNEL); + if (!builder) + return NULL; + builder->modify = modify; return builder;
In mlx5e_tir_builder_alloc() kvzalloc() may return NULL which is dereferenced on the next line in a reference to the modify field. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a6696735d694 ("net/mlx5e: Convert TIR to a dedicated object") Signed-off-by: Elena Salomatkina <esalomatkina@ispras.ru> --- v2: Fix tab, add blank line drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 +++ 1 file changed, 3 insertions(+)