| Message ID | 20240626153421.102107-1-hengqi@linux.alibaba.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: ethtool: Fix the panic caused by dev being null when dumping coalesce | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Clearly marked for net |
| netdev/apply | fail | Patch does not apply to net-0 |
On Wed, 26 Jun 2024 23:34:21 +0800 Heng Qi wrote:
> The problematic commit targeted by this fix may still be in the next branch.
Could you resend with [PATCH net-next] in the subject instead, in this
case? Our build bot trusts the designation in the subject so since this
was submitted as "PATCH net" and patch doesn't apply to net - it
rejected the patch.
On Thu, 27 Jun 2024 12:39:32 -0700, Jakub Kicinski <kuba@kernel.org> wrote: > On Wed, 26 Jun 2024 23:34:21 +0800 Heng Qi wrote: > > The problematic commit targeted by this fix may still be in the next branch. > > Could you resend with [PATCH net-next] in the subject instead, in this > case? Our build bot trusts the designation in the subject so since this > was submitted as "PATCH net" and patch doesn't apply to net - it > rejected the patch. Hi, Jakub The new patch has been submitted to: https://lore.kernel.org/all/20240628044018.73885-1-hengqi@linux.alibaba.com/ Thanks. > -- > pw-bot: cr
diff --git a/net/ethtool/coalesce.c b/net/ethtool/coalesce.c index 759b16e3d134..3e18ca1ccc5e 100644 --- a/net/ethtool/coalesce.c +++ b/net/ethtool/coalesce.c @@ -211,9 +211,9 @@ static int coalesce_fill_reply(struct sk_buff *skb, { const struct coalesce_reply_data *data = COALESCE_REPDATA(reply_base); const struct kernel_ethtool_coalesce *kcoal = &data->kernel_coalesce; - struct dim_irq_moder *moder = req_base->dev->irq_moder; const struct ethtool_coalesce *coal = &data->coalesce; u32 supported = data->supported_params; + struct dim_irq_moder *moder; int ret = 0; if (coalesce_put_u32(skb, ETHTOOL_A_COALESCE_RX_USECS, @@ -272,9 +272,10 @@ static int coalesce_fill_reply(struct sk_buff *skb, kcoal->tx_aggr_time_usecs, supported)) return -EMSGSIZE; - if (!moder) + if (!req_base->dev || !req_base->dev->irq_moder) return 0; + moder = req_base->dev->irq_moder; rcu_read_lock(); if (moder->profile_flags & DIM_PROFILE_RX) { ret = coalesce_put_profile(skb, ETHTOOL_A_COALESCE_RX_PROFILE,
syzbot reported a general protection fault caused by a null pointer dereference in coalesce_fill_reply(). The issue occurs when req_base->dev is null, leading to an invalid memory access. This panic occurs if dumping coalesce when no device name is specified. Fixes: f750dfe825b9 ("ethtool: provide customized dim profile management") Reported-by: syzbot+e77327e34cdc8c36b7d3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e77327e34cdc8c36b7d3 Signed-off-by: Heng Qi <hengqi@linux.alibaba.com> --- The problematic commit targeted by this fix may still be in the next branch. net/ethtool/coalesce.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)