diff mbox series

[net] net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs()

Message ID 20210624155207.1005043-1-olteanv@gmail.com (mailing list archive)
State Accepted
Commit be7f62eebaff2f86c1467a2d33930a0a7a87675b
Delegated to: Netdev Maintainers
Headers show
Series [net] net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs() | expand

Checks

Context Check Description
netdev/cover_letter success Link
netdev/fixes_present success Link
netdev/patch_count success Link
netdev/tree_selection success Clearly marked for net
netdev/subject_prefix success Link
netdev/cc_maintainers success CCed 7 of 7 maintainers
netdev/source_inline success Was 0 now: 0
netdev/verify_signedoff success Link
netdev/module_param success Was 0 now: 0
netdev/build_32bit success Errors and warnings before: 0 this patch: 0
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/verify_fixes success Link
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 12 lines checked
netdev/build_allmodconfig_warn success Errors and warnings before: 0 this patch: 0
netdev/header_inline success Link

Commit Message

Vladimir Oltean June 24, 2021, 3:52 p.m. UTC 
From: Vladimir Oltean <vladimir.oltean@nxp.com>

priv->cbs is an array of priv->info->num_cbs_shapers elements of type
struct sja1105_cbs_entry which only get allocated if CONFIG_NET_SCH_CBS
is enabled.

However, sja1105_reload_cbs() is called from sja1105_static_config_reload()
which in turn is called for any of the items in sja1105_reset_reasons,
therefore during the normal runtime of the driver and not just from a
code path which can be triggered by the tc-cbs offload.

The sja1105_reload_cbs() function does not contain a check whether the
priv->cbs array is NULL or not, it just assumes it isn't and proceeds to
iterate through the credit-based shaper elements. This leads to a NULL
pointer dereference.

The solution is to return success if the priv->cbs array has not been
allocated, since sja1105_reload_cbs() has nothing to do.

Fixes: 4d7525085a9b ("net: dsa: sja1105: offload the Credit-Based Shaper qdisc")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
---
 drivers/net/dsa/sja1105/sja1105_main.c | 6 ++++++
 1 file changed, 6 insertions(+)

Comments

patchwork-bot+netdevbpf@kernel.org June 24, 2021, 10:50 p.m. UTC | #1 
Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Thu, 24 Jun 2021 18:52:07 +0300 you wrote:
> From: Vladimir Oltean <vladimir.oltean@nxp.com>
> 
> priv->cbs is an array of priv->info->num_cbs_shapers elements of type
> struct sja1105_cbs_entry which only get allocated if CONFIG_NET_SCH_CBS
> is enabled.
> 
> However, sja1105_reload_cbs() is called from sja1105_static_config_reload()
> which in turn is called for any of the items in sja1105_reset_reasons,
> therefore during the normal runtime of the driver and not just from a
> code path which can be triggered by the tc-cbs offload.
> 
> [...]

Here is the summary with links:
  - [net] net: dsa: sja1105: fix NULL pointer dereference in sja1105_reload_cbs()
    https://git.kernel.org/netdev/net/c/be7f62eebaff

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index a9777eb564c6..4f0545605f6b 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1818,6 +1818,12 @@  static int sja1105_reload_cbs(struct sja1105_private *priv)
 {
 	int rc = 0, i;
 
+	/* The credit based shapers are only allocated if
+	 * CONFIG_NET_SCH_CBS is enabled.
+	 */
+	if (!priv->cbs)
+		return 0;
+
 	for (i = 0; i < priv->info->num_cbs_shapers; i++) {
 		struct sja1105_cbs_entry *cbs = &priv->cbs[i];