2024-03-07 09:37:48

by Aleksandr Mishin

Subject: [PATCH] liquidio: Fix potential null pointer dereference

In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
but then it is unconditionally passed to skb_add_rx_frag() which could
lead to null pointer dereference.
Fix this bug by moving skb_add_rx_frag() into conditional scope.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1f233f327913 (liquidio: switchdev support for LiquidIO NIC)
Signed-off-by: Aleksandr Mishin <[email protected]>
---
drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
index aa6c0dfb6f1c..e26b4ed33dc8 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
@@ -272,13 +272,12 @@ lio_vf_rep_copy_packet(struct octeon_device *oct,
pg_info->page_offset;
memcpy(skb->data, va, MIN_SKB_SIZE);
skb_put(skb, MIN_SKB_SIZE);
+ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ pg_info->page,
+ pg_info->page_offset + MIN_SKB_SIZE,
+ len - MIN_SKB_SIZE,
+ LIO_RXBUFFER_SZ);
}
-
- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
- pg_info->page,
- pg_info->page_offset + MIN_SKB_SIZE,
- len - MIN_SKB_SIZE,
- LIO_RXBUFFER_SZ);
} else {
struct octeon_skb_page_info *pg_info =
((struct octeon_skb_page_info *)(skb->cb));
--
2.30.2

2024-03-08 20:19:28

by Simon Horman

Subject: Re: [PATCH] liquidio: Fix potential null pointer dereference

On Thu, Mar 07, 2024 at 12:29:32PM +0300, Aleksandr Mishin wrote:
> In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
> but then it is unconditionally passed to skb_add_rx_frag() which could
> lead to null pointer dereference.
> Fix this bug by moving skb_add_rx_frag() into conditional scope.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 1f233f327913 (liquidio: switchdev support for LiquidIO NIC)

A correct format for the tag above is:

Fixes: 1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")

> Signed-off-by: Aleksandr Mishin <[email protected]>

I guess this code is never hit.
But I agree this should be fixed.

Reviewed-by: Simon Horman <[email protected]>

2024-03-09 20:45:45

by Kees Cook

Subject: Re: [PATCH] liquidio: Fix potential null pointer dereference

On Fri, Mar 08, 2024 at 08:19:11PM +0000, Simon Horman wrote:
> On Thu, Mar 07, 2024 at 12:29:32PM +0300, Aleksandr Mishin wrote:
> > In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
> > but then it is unconditionally passed to skb_add_rx_frag() which could
> > lead to null pointer dereference.
> > Fix this bug by moving skb_add_rx_frag() into conditional scope.
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> >
> > Fixes: 1f233f327913 (liquidio: switchdev support for LiquidIO NIC)
>
> A correct format for the tag above is:
>
> Fixes: 1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")

FWIW, I have this in my ~/.gitconfig[1]:

[alias]
short = "!f() { for i in \"$@\"; do git log -1 --pretty='%h (\"%s\")' \"$i\"; done; }; f"


then I can type:

$ short 1f233f327913f3dee0602cba9c64df1903772b55
1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")


-Kees

[1] https://github.com/kees/kernel-tools/blob/trunk/ENVIRONMENT.md#git-command-aliases-gitconfig

--
Kees Cook