| Message ID | 20210111181138.49757-1-cristian.dumitrescu@intel.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 7128c834d30e6b2cf649f14d8fc274941786d0e1 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] i40e: fix potential NULL pointer dereferencing | expand |
On 2021-01-11 19:11, Cristian Dumitrescu wrote: > Currently, the function i40e_construct_skb_zc only frees the input xdp > buffer when the output skb is successfully built. On error, the > function i40e_clean_rx_irq_zc does not commit anything for the current > packet descriptor and simply exits the packet descriptor processing > loop, with the plan to restart the processing of this descriptor on > the next invocation. Therefore, on error the ring next-to-clean > pointer should not advance, the xdp i.e. *bi buffer should not be > freed and the current buffer info should not be invalidated by setting > *bi to NULL. Therefore, the *bi should only be set to NULL when the > function i40e_construct_skb_zc is successful, otherwise a NULL *bi > will be dereferenced when the work for the current descriptor is > eventually restarted. > > Fixes: 3b4f0b66c2b3 ("i40e, xsk: Migrate to new MEM_TYPE_XSK_BUFF_POOL") > Signed-off-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com> Thanks for finding and fixing this, Cristian! Acked-by: Björn Töpel <bjorn.topel@intel.com> > --- > drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c > index 47eb9c584a12..492ce213208d 100644 > --- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c > +++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c > @@ -348,12 +348,12 @@ int i40e_clean_rx_irq_zc(struct i40e_ring *rx_ring, int budget) > * SBP is *not* set in PRT_SBPVSI (default not set). > */ > skb = i40e_construct_skb_zc(rx_ring, *bi); > - *bi = NULL; > if (!skb) { > rx_ring->rx_stats.alloc_buff_failed++; > break; > } > > + *bi = NULL; > cleaned_count++; > i40e_inc_ntc(rx_ring); > >
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Mon, 11 Jan 2021 18:11:38 +0000 you wrote: > Currently, the function i40e_construct_skb_zc only frees the input xdp > buffer when the output skb is successfully built. On error, the > function i40e_clean_rx_irq_zc does not commit anything for the current > packet descriptor and simply exits the packet descriptor processing > loop, with the plan to restart the processing of this descriptor on > the next invocation. Therefore, on error the ring next-to-clean > pointer should not advance, the xdp i.e. *bi buffer should not be > freed and the current buffer info should not be invalidated by setting > *bi to NULL. Therefore, the *bi should only be set to NULL when the > function i40e_construct_skb_zc is successful, otherwise a NULL *bi > will be dereferenced when the work for the current descriptor is > eventually restarted. > > [...] Here is the summary with links: - [net] i40e: fix potential NULL pointer dereferencing https://git.kernel.org/netdev/net/c/7128c834d30e You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c index 47eb9c584a12..492ce213208d 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c +++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c @@ -348,12 +348,12 @@ int i40e_clean_rx_irq_zc(struct i40e_ring *rx_ring, int budget) * SBP is *not* set in PRT_SBPVSI (default not set). */ skb = i40e_construct_skb_zc(rx_ring, *bi); - *bi = NULL; if (!skb) { rx_ring->rx_stats.alloc_buff_failed++; break; } + *bi = NULL; cleaned_count++; i40e_inc_ntc(rx_ring);
Currently, the function i40e_construct_skb_zc only frees the input xdp buffer when the output skb is successfully built. On error, the function i40e_clean_rx_irq_zc does not commit anything for the current packet descriptor and simply exits the packet descriptor processing loop, with the plan to restart the processing of this descriptor on the next invocation. Therefore, on error the ring next-to-clean pointer should not advance, the xdp i.e. *bi buffer should not be freed and the current buffer info should not be invalidated by setting *bi to NULL. Therefore, the *bi should only be set to NULL when the function i40e_construct_skb_zc is successful, otherwise a NULL *bi will be dereferenced when the work for the current descriptor is eventually restarted. Fixes: 3b4f0b66c2b3 ("i40e, xsk: Migrate to new MEM_TYPE_XSK_BUFF_POOL") Signed-off-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com> --- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)