| Message ID | 20250213040754.1473-1-vulab@iscas.ac.cn (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net: dsa: felix: Add NULL check for outer_tagging_rule() | expand |
On Thu, Feb 13, 2025 at 12:07:54PM +0800, Wentao Liang wrote: > In felix_update_tag_8021q_rx_rules(), the return value of > ocelot_vcap_block_find_filter_by_id() is not checked, which could > lead to a NULL pointer dereference if the filter is not found. > > Add the necessary check and use `continue` to skip the current CPU > port if the filter is not found, ensuring that all CPU ports are > processed. > > Fixes: f1288fd7293b ("net: dsa: felix: fix VLAN tag loss on CPU reception with ocelot-8021q") > Cc: stable@vger.kernel.org # 6.11+ > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> > --- > drivers/net/dsa/ocelot/felix.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c > index 3aa9c997018a..10ad43108b88 100644 > --- a/drivers/net/dsa/ocelot/felix.c > +++ b/drivers/net/dsa/ocelot/felix.c > @@ -348,6 +348,8 @@ static int felix_update_tag_8021q_rx_rules(struct dsa_switch *ds, int port, > > outer_tagging_rule = ocelot_vcap_block_find_filter_by_id(block_vcap_es0, > cookie, false); > + if (!outer_tagging_rule) > + continue; > > felix_update_tag_8021q_rx_rule(outer_tagging_rule, vlan_filtering); > All other calls to ocelot_vcap_block_find_filter_by_id() are checked, so looks correct, thanks. Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> > -- > 2.42.0.windows.2
On Thu, Feb 13, 2025 at 12:07:54PM +0800, Wentao Liang wrote: > In felix_update_tag_8021q_rx_rules(), the return value of > ocelot_vcap_block_find_filter_by_id() is not checked, which could > lead to a NULL pointer dereference if the filter is not found. > > Add the necessary check and use `continue` to skip the current CPU > port if the filter is not found, ensuring that all CPU ports are > processed. Thanks for reworking the commit message. You should include a version number in the Subject: line, so we can keep track of the different versions: https://docs.kernel.org/process/submitting-patches.html See the Section about "Subject Line". Also, you should include a brief history of the patches, what changed between each version under the --- marker. There is no need to resend, please just remember these things for you next patch you submit. Reviewed-by: Andrew Lunn <andrew@lunn.ch> Andrew
On Thu, Feb 13, 2025 at 12:07:54PM +0800, Wentao Liang wrote: > In felix_update_tag_8021q_rx_rules(), the return value of > ocelot_vcap_block_find_filter_by_id() is not checked, which could > lead to a NULL pointer dereference if the filter is not found. > > Add the necessary check and use `continue` to skip the current CPU > port if the filter is not found, ensuring that all CPU ports are > processed. > > Fixes: f1288fd7293b ("net: dsa: felix: fix VLAN tag loss on CPU reception with ocelot-8021q") > Cc: stable@vger.kernel.org # 6.11+ > Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> > --- > drivers/net/dsa/ocelot/felix.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c > index 3aa9c997018a..10ad43108b88 100644 > --- a/drivers/net/dsa/ocelot/felix.c > +++ b/drivers/net/dsa/ocelot/felix.c > @@ -348,6 +348,8 @@ static int felix_update_tag_8021q_rx_rules(struct dsa_switch *ds, int port, > > outer_tagging_rule = ocelot_vcap_block_find_filter_by_id(block_vcap_es0, > cookie, false); > + if (!outer_tagging_rule) > + continue; > > felix_update_tag_8021q_rx_rule(outer_tagging_rule, vlan_filtering); > > -- > 2.42.0.windows.2 > Is this patch a result of static analysis or has a real problem been noticed? Could you make a more detailed analysis for me of the code path in which the filter cannot be found? because I'm not seeing it. Hint: follow felix_change_tag_protocol(), and see which things are guaranteed to have succeeded if felix->tag_proto == DSA_TAG_PROTO_OCELOT_8021Q. felix_tag_8021q_vlan_add() is called from dsa_tag_8021q_register(), and felix_tag_8021q_vlan_del() from dsa_tag_8021q_unregister(). felix_vlan_filtering() runs under rtnl_lock(), and so does felix_change_tag_protocol(). So felix_vlan_filtering() is always executed either entirely before, or entirely after felix_change_tag_protocol(), never concurrently.
diff --git a/drivers/net/dsa/ocelot/felix.c b/drivers/net/dsa/ocelot/felix.c index 3aa9c997018a..10ad43108b88 100644 --- a/drivers/net/dsa/ocelot/felix.c +++ b/drivers/net/dsa/ocelot/felix.c @@ -348,6 +348,8 @@ static int felix_update_tag_8021q_rx_rules(struct dsa_switch *ds, int port, outer_tagging_rule = ocelot_vcap_block_find_filter_by_id(block_vcap_es0, cookie, false); + if (!outer_tagging_rule) + continue; felix_update_tag_8021q_rx_rule(outer_tagging_rule, vlan_filtering);
In felix_update_tag_8021q_rx_rules(), the return value of ocelot_vcap_block_find_filter_by_id() is not checked, which could lead to a NULL pointer dereference if the filter is not found. Add the necessary check and use `continue` to skip the current CPU port if the filter is not found, ensuring that all CPU ports are processed. Fixes: f1288fd7293b ("net: dsa: felix: fix VLAN tag loss on CPU reception with ocelot-8021q") Cc: stable@vger.kernel.org # 6.11+ Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> --- drivers/net/dsa/ocelot/felix.c | 2 ++ 1 file changed, 2 insertions(+)