| Message ID | 20250127103836.4742-1-piotr.kwapulinski@intel.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [iwl-next,v3] ixgbe: Fix possible skb NULL pointer dereference | expand |
On Mon, Jan 27, 2025 at 11:38:36AM +0100, Piotr Kwapulinski wrote: > The commit c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in > ixgbe_run_xdp()") stopped utilizing the ERR-like macros for xdp status > encoding. Propagate this logic to the ixgbe_put_rx_buffer(). > > The commit also relaxed the skb NULL pointer check - caught by Smatch. > Restore this check. > > Fixes: c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") > Reported-by: Dan Carpenter <dan.carpenter@linaro.org> > Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> > --- > drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > index 7236f20..467f812 100644 > --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c > @@ -2105,7 +2105,7 @@ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, > /* hand second half of page back to the ring */ > ixgbe_reuse_rx_page(rx_ring, rx_buffer); > } else { > - if (!IS_ERR(skb) && IXGBE_CB(skb)->dma == rx_buffer->dma) { > + if (skb && IXGBE_CB(skb)->dma == rx_buffer->dma) { > /* the page has been released from the ring */ > IXGBE_CB(skb)->page_released = true; > } else { > -- > v1 -> v2 > Provide extra details in commit message for motivation of this patch. > v2 -> v3 > Simplify the check condition Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Thanks! > > 2.43.0 >
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c index 7236f20..467f812 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c @@ -2105,7 +2105,7 @@ static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, /* hand second half of page back to the ring */ ixgbe_reuse_rx_page(rx_ring, rx_buffer); } else { - if (!IS_ERR(skb) && IXGBE_CB(skb)->dma == rx_buffer->dma) { + if (skb && IXGBE_CB(skb)->dma == rx_buffer->dma) { /* the page has been released from the ring */ IXGBE_CB(skb)->page_released = true; } else {
The commit c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") stopped utilizing the ERR-like macros for xdp status encoding. Propagate this logic to the ixgbe_put_rx_buffer(). The commit also relaxed the skb NULL pointer check - caught by Smatch. Restore this check. Fixes: c824125cbb18 ("ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()") Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Piotr Kwapulinski <piotr.kwapulinski@intel.com> --- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)