From patchwork Thu Jun 15 09:45:36 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Horman X-Patchwork-Id: 13280991 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6B9F5697; Thu, 15 Jun 2023 09:45:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF640C433C8; Thu, 15 Jun 2023 09:45:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1686822357; bh=VXmgec0SvoWNjD+zQJUGR2dz0bJtpAmkZ85WuhMZ1Vk=; h=From:Date:Subject:To:Cc:From; b=ul02Ap/uEzBhWv5cvpcsaJ49I13Y8VZvNH5Lz1HvhDCmylTKEAaFsm2M3XlB7l1E7 D9qWbeZtCI77KdL8iMwRa2zC26kh7u8TiVOK9Ja0OmiVBFdOemN/3NNEKpPigwEE8W c96Vto88G0n29VaVkOeWa5A/KfqIZy7+ZM5/ZkWwVNuoryumL7+mHaAS/+swfQECKv HdXS+ZbvFgplp//3I6dI0sGR54dkLMw/6hZuYIQtCe4SvHO9ThGbRNYXmJM6OUQMVM u/NQIweyXo9T0lWOtT/+xoUjwIIQTNZ9FsVhd7WxrIGSpCZp2q5nkvueUoo0WjRCnP EqWj4wLbDtf+Q== From: Simon Horman Date: Thu, 15 Jun 2023 11:45:36 +0200 Subject: [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx_irq() Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20230615-igc-err-ptr-v1-1-a17145eb8d62@kernel.org> X-B4-Tracking: v=1; b=H4sIAL/dimQC/x2NwQrCQAwFf2XJ2cB2pSJeBT/Aq3jYpq9toKwlW 0Uo/XeDxxkYZqMKU1S6hI0MH636Kg7NIZBMuYxg7Z0pxXSMp6ZlHYVhxstq3AKDIMm5j5m86HI Fd5aLTN6U9zy7XAyDfv+LB91v11Cw0nPffyFv31Z7AAAA To: Jesse Brandeburg , Tony Nguyen Cc: Alexei Starovoitov , Andre Guedes , Dan Carpenter , Daniel Borkmann , "David S. Miller" , Eric Dumazet , Florian Kauer , Jakub Kicinski , Jesper Dangaard Brouer , Jithu Joseph , John Fastabend , Maciej Fijalkowski , Paolo Abeni , Vedang Patel , intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, bpf@vger.kernel.org X-Mailer: b4 0.12.2 X-Patchwork-Delegate: kuba@kernel.org X-Patchwork-State: RFC In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned to the skb local variable. This may be an ERR_PTR. A little later the following is executed, which seems to be a possible dereference of an ERR_PTR. total_bytes += skb->len; Avoid this problem by continuing the loop in which all of the above occurs once the handling of the NULL case completes. This proposed fix is speculative - I do not have deep knowledge of this driver. And I am concerned about the effect of skipping the following logic: igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt); cleaned_count++; Flagged by Smatch as: .../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR' Compile tested only. Fixes: 26575105d6ed ("igc: Add initial XDP support") Signed-off-by: Simon Horman --- drivers/net/ethernet/intel/igc/igc_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c index 88145c30c919..b58c8a674bd1 100644 --- a/drivers/net/ethernet/intel/igc/igc_main.c +++ b/drivers/net/ethernet/intel/igc/igc_main.c @@ -2586,6 +2586,7 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget) total_packets++; total_bytes += size; + continue; } else if (skb) igc_add_rx_frag(rx_ring, rx_buffer, skb, size); else if (ring_uses_build_skb(rx_ring))