From patchwork Mon Jan 11 18:11:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Cristian Dumitrescu X-Patchwork-Id: 12011357 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66688C43381 for ; Mon, 11 Jan 2021 18:12:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 41D4F225AB for ; Mon, 11 Jan 2021 18:12:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390289AbhAKSMV (ORCPT ); Mon, 11 Jan 2021 13:12:21 -0500 Received: from mga17.intel.com ([192.55.52.151]:35017 "EHLO mga17.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390091AbhAKSMV (ORCPT ); Mon, 11 Jan 2021 13:12:21 -0500 IronPort-SDR: sdc/Ts50gjU+lJVh0R9YpkeZgbT9JvUlDVjBg/XY8Ow9Smq+bixkD90wT7r99N0RZkkIPJH3Rr CrB4hj3yA+gQ== X-IronPort-AV: E=McAfee;i="6000,8403,9861"; a="157688214" X-IronPort-AV: E=Sophos;i="5.79,339,1602572400"; d="scan'208";a="157688214" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Jan 2021 10:11:41 -0800 IronPort-SDR: Mohv5/ZA6vCRs2JGSYialOXSsXTIr3PGlOKUqmaKg4rqZ5SKt70ZpQJ7D1TE4tp58nRx1wKf9i ZR5uldA1Sa1Q== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.79,339,1602572400"; d="scan'208";a="498653463" Received: from silpixa00400572.ir.intel.com ([10.237.213.34]) by orsmga004.jf.intel.com with ESMTP; 11 Jan 2021 10:11:39 -0800 From: Cristian Dumitrescu To: intel-wired-lan@lists.osuosl.org Cc: bpf@vger.kernel.org, netdev@vger.kernel.org, magnus.karlsson@intel.com, bjorn.topel@intel.com, maciej.fijalkowski@intel.com, cristian.dumitrescu@intel.com Subject: [PATCH net] i40e: fix potential NULL pointer dereferencing Date: Mon, 11 Jan 2021 18:11:38 +0000 Message-Id: <20210111181138.49757-1-cristian.dumitrescu@intel.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org Currently, the function i40e_construct_skb_zc only frees the input xdp buffer when the output skb is successfully built. On error, the function i40e_clean_rx_irq_zc does not commit anything for the current packet descriptor and simply exits the packet descriptor processing loop, with the plan to restart the processing of this descriptor on the next invocation. Therefore, on error the ring next-to-clean pointer should not advance, the xdp i.e. *bi buffer should not be freed and the current buffer info should not be invalidated by setting *bi to NULL. Therefore, the *bi should only be set to NULL when the function i40e_construct_skb_zc is successful, otherwise a NULL *bi will be dereferenced when the work for the current descriptor is eventually restarted. Fixes: 3b4f0b66c2b3 ("i40e, xsk: Migrate to new MEM_TYPE_XSK_BUFF_POOL") Signed-off-by: Cristian Dumitrescu Acked-by: Björn Töpel --- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c index 47eb9c584a12..492ce213208d 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c +++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c @@ -348,12 +348,12 @@ int i40e_clean_rx_irq_zc(struct i40e_ring *rx_ring, int budget) * SBP is *not* set in PRT_SBPVSI (default not set). */ skb = i40e_construct_skb_zc(rx_ring, *bi); - *bi = NULL; if (!skb) { rx_ring->rx_stats.alloc_buff_failed++; break; } + *bi = NULL; cleaned_count++; i40e_inc_ntc(rx_ring);