2018-04-03 22:05:55

by Gustavo A. R. Silva

Subject: [PATCH v2] net: thunderx: nicvf_main: Fix potential NULL pointer dereferences

Add null check on kmalloc() return value in order to prevent
a null pointer dereference.

Addresses-Coverity-ID: 1467429 ("Dereference null return value")
Fixes: 37c3347eb247 ("net: thunderx: add ndo_set_rx_mode callback implementation for VF")
Signed-off-by: Gustavo A. R. Silva <[email protected]>
---
Changes in v2:
- Add a null check on a second kmalloc a few lines below. Thanks to
Eric Dumazet for pointing this out.

drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 1e9a31f..f7b5ca5 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1999,10 +1999,14 @@ static void nicvf_set_rx_mode(struct net_device *netdev)
struct xcast_addr *xaddr;

mc_list = kmalloc(sizeof(*mc_list), GFP_ATOMIC);
+ if (unlikely(!mc_list))
+ return;
INIT_LIST_HEAD(&mc_list->list);
netdev_hw_addr_list_for_each(ha, &netdev->mc) {
xaddr = kmalloc(sizeof(*xaddr),
GFP_ATOMIC);
+ if (unlikely(!xaddr))
+ return;
xaddr->addr =
ether_addr_to_u64(ha->addr);
list_add_tail(&xaddr->list,
--
2.7.4

2018-04-04 06:38:15

by Eric Dumazet

Subject: Re: [PATCH v2] net: thunderx: nicvf_main: Fix potential NULL pointer dereferences

On 04/03/2018 03:04 PM, Gustavo A. R. Silva wrote:
> Add null check on kmalloc() return value in order to prevent
> a null pointer dereference.
>
> Addresses-Coverity-ID: 1467429 ("Dereference null return value")
> Fixes: 37c3347eb247 ("net: thunderx: add ndo_set_rx_mode callback implementation for VF")
> Signed-off-by: Gustavo A. R. Silva <[email protected]>
> ---
> Changes in v2:
> - Add a null check on a second kmalloc a few lines below. Thanks to
> Eric Dumazet for pointing this out.
>
> drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
> index 1e9a31f..f7b5ca5 100644
> --- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
> +++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
> @@ -1999,10 +1999,14 @@ static void nicvf_set_rx_mode(struct net_device *netdev)
> struct xcast_addr *xaddr;
>
> mc_list = kmalloc(sizeof(*mc_list), GFP_ATOMIC);
> + if (unlikely(!mc_list))
> + return;
> INIT_LIST_HEAD(&mc_list->list);
> netdev_hw_addr_list_for_each(ha, &netdev->mc) {
> xaddr = kmalloc(sizeof(*xaddr),
> GFP_ATOMIC);
> + if (unlikely(!xaddr))
> + return;

So now you leak memory :/

If you fix bugs, please do not add new ones.

> xaddr->addr =
> ether_addr_to_u64(ha->addr);
> list_add_tail(&xaddr->list,
>

2018-04-04 06:43:01

by Gustavo A. R. Silva

Subject: Re: [PATCH v2] net: thunderx: nicvf_main: Fix potential NULL pointer dereferences

On 04/04/2018 01:36 AM, Eric Dumazet wrote:
>
>
> On 04/03/2018 03:04 PM, Gustavo A. R. Silva wrote:
>> Add null check on kmalloc() return value in order to prevent
>> a null pointer dereference.
>>
>> Addresses-Coverity-ID: 1467429 ("Dereference null return value")
>> Fixes: 37c3347eb247 ("net: thunderx: add ndo_set_rx_mode callback implementation for VF")
>> Signed-off-by: Gustavo A. R. Silva <[email protected]>
>> ---
>> Changes in v2:
>> - Add a null check on a second kmalloc a few lines below. Thanks to
>> Eric Dumazet for pointing this out.
>>
>> drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
>> index 1e9a31f..f7b5ca5 100644
>> --- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
>> +++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
>> @@ -1999,10 +1999,14 @@ static void nicvf_set_rx_mode(struct net_device *netdev)
>> struct xcast_addr *xaddr;
>>
>> mc_list = kmalloc(sizeof(*mc_list), GFP_ATOMIC);
>> + if (unlikely(!mc_list))
>> + return;
>> INIT_LIST_HEAD(&mc_list->list);
>> netdev_hw_addr_list_for_each(ha, &netdev->mc) {
>> xaddr = kmalloc(sizeof(*xaddr),
>> GFP_ATOMIC);
>> + if (unlikely(!xaddr))
>> + return;
>
> So now you leak memory :/
>

Oh god. I'm sorry.

I had problems with this file since the beginning.

I'll send v3 shortly.

Thanks
--
Gustavo

2018-04-05 12:40:02

by Vadim Lomovtsev

Subject: Re: [v2] net: thunderx: nicvf_main: Fix potential NULL pointer dereferences

Hi guys,

Please give me couple days to workout solution for this.
I'll post patch for this as soon as I done with my testing.

WBR,
Vadim

On Tue, Apr 03, 2018 at 05:04:23PM -0500, Gustavo A. R. Silva wrote:
> Add null check on kmalloc() return value in order to prevent
> a null pointer dereference.
>
> Addresses-Coverity-ID: 1467429 ("Dereference null return value")
> Fixes: 37c3347eb247 ("net: thunderx: add ndo_set_rx_mode callback implementation for VF")
> Signed-off-by: Gustavo A. R. Silva <[email protected]>
> ---
> Changes in v2:
> - Add a null check on a second kmalloc a few lines below. Thanks to
> Eric Dumazet for pointing this out.
>
> drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
> index 1e9a31f..f7b5ca5 100644
> --- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
> +++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
> @@ -1999,10 +1999,14 @@ static void nicvf_set_rx_mode(struct net_device *netdev)
> struct xcast_addr *xaddr;
>
> mc_list = kmalloc(sizeof(*mc_list), GFP_ATOMIC);
> + if (unlikely(!mc_list))
> + return;
> INIT_LIST_HEAD(&mc_list->list);
> netdev_hw_addr_list_for_each(ha, &netdev->mc) {
> xaddr = kmalloc(sizeof(*xaddr),
> GFP_ATOMIC);
> + if (unlikely(!xaddr))
> + return;
> xaddr->addr =
> ether_addr_to_u64(ha->addr);
> list_add_tail(&xaddr->list,