2023-12-11 06:27:55

by Kunwu Chan

[permalink] [raw]
Subject: [PATCH] ice: Fix some null pointer dereference issues in ice_ptp.c

devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.

Fixes: d938a8cca88a ("ice: Auxbus devices & driver for E822 TS")
Cc: Kunwu Chan <[email protected]>
Signed-off-by: Kunwu Chan <[email protected]>
---
drivers/net/ethernet/intel/ice/ice_ptp.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 1eddcbe89b0c..59794ce4f243 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -2668,6 +2668,8 @@ static int ice_ptp_register_auxbus_driver(struct ice_pf *pf)
name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
ice_get_ptp_src_clock_index(&pf->hw));
+ if (!name)
+ return -ENOMEM;

aux_driver->name = name;
aux_driver->shutdown = ice_ptp_auxbus_shutdown;
@@ -2929,6 +2931,10 @@ static int ice_ptp_create_auxbus_device(struct ice_pf *pf)
name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
ice_get_ptp_src_clock_index(&pf->hw));
+ if (!name) {
+ dev_err(dev, "Failed to allocate memory\n");
+ return -ENOMEM;
+ }

aux_dev->name = name;
aux_dev->id = id;
--
2.39.2


2023-12-11 07:17:21

by Przemek Kitszel

[permalink] [raw]
Subject: Re: [PATCH] ice: Fix some null pointer dereference issues in ice_ptp.c

On 12/11/23 07:26, Kunwu Chan wrote:
> devm_kasprintf() returns a pointer to dynamically allocated memory
> which can be NULL upon failure.
>
> Fixes: d938a8cca88a ("ice: Auxbus devices & driver for E822 TS")
> Cc: Kunwu Chan <[email protected]>
> Signed-off-by: Kunwu Chan <[email protected]>

I would suggest adding "iwl-net" as a target here

> ---
> drivers/net/ethernet/intel/ice/ice_ptp.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
> index 1eddcbe89b0c..59794ce4f243 100644
> --- a/drivers/net/ethernet/intel/ice/ice_ptp.c
> +++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
> @@ -2668,6 +2668,8 @@ static int ice_ptp_register_auxbus_driver(struct ice_pf *pf)
> name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
> pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
> ice_get_ptp_src_clock_index(&pf->hw));
> + if (!name)
> + return -ENOMEM;
>
> aux_driver->name = name;
> aux_driver->shutdown = ice_ptp_auxbus_shutdown;
> @@ -2929,6 +2931,10 @@ static int ice_ptp_create_auxbus_device(struct ice_pf *pf)
> name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
> pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
> ice_get_ptp_src_clock_index(&pf->hw));
> + if (!name) {
> + dev_err(dev, "Failed to allocate memory\n");

Kuba @ [1]:
no warnings on allocation failures, there will be a splat for GFP_KERNEL
(checkpatch should catch this)

[1] https://lore.kernel.org/netdev/[email protected]/T/

so just "return -ENOMEM" would be sufficient

> + return -ENOMEM;
> + }
>
> aux_dev->name = name;
> aux_dev->id = id;

I didn't checked but having same code in two places raises questions.
Are you overwriting old name here, or our code is just self similar?

2023-12-11 09:32:31

by Kunwu Chan

[permalink] [raw]
Subject: Re: [PATCH] ice: Fix some null pointer dereference issues in ice_ptp.c

Thanks for your suggestion.

I made the patch based on linux-next.git(tag:next-20231211).

Our code is just self-similar, i didn't override the old name.
I keep the logic as it was before.
The newest code is:

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/net/ethernet/intel/ice/ice_ptp.c#n2747

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/net/ethernet/intel/ice/ice_ptp.c#n2993

I'll update v2 patch with:
1. update suject prefix to "[PATCH v2 iwl-next]"
2. remove 'dev_err'


Thanks again,
Kunwu

On 2023/12/11 15:15, Przemek Kitszel wrote:
> On 12/11/23 07:26, Kunwu Chan wrote:
>> devm_kasprintf() returns a pointer to dynamically allocated memory
>> which can be NULL upon failure.
>>
>> Fixes: d938a8cca88a ("ice: Auxbus devices & driver for E822 TS")
>> Cc: Kunwu Chan <[email protected]>
>> Signed-off-by: Kunwu Chan <[email protected]>
>
> I would suggest adding "iwl-net" as a target here
>
>> ---
>>   drivers/net/ethernet/intel/ice/ice_ptp.c | 6 ++++++
>>   1 file changed, 6 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c
>> b/drivers/net/ethernet/intel/ice/ice_ptp.c
>> index 1eddcbe89b0c..59794ce4f243 100644
>> --- a/drivers/net/ethernet/intel/ice/ice_ptp.c
>> +++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
>> @@ -2668,6 +2668,8 @@ static int ice_ptp_register_auxbus_driver(struct
>> ice_pf *pf)
>>       name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
>>                     pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
>>                     ice_get_ptp_src_clock_index(&pf->hw));
>> +    if (!name)
>> +        return -ENOMEM;
>>       aux_driver->name = name;
>>       aux_driver->shutdown = ice_ptp_auxbus_shutdown;
>> @@ -2929,6 +2931,10 @@ static int ice_ptp_create_auxbus_device(struct
>> ice_pf *pf)
>>       name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
>>                     pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
>>                     ice_get_ptp_src_clock_index(&pf->hw));
>> +    if (!name) {
>> +        dev_err(dev, "Failed to allocate memory\n");
>
> Kuba @ [1]:
> no warnings on allocation failures, there will be a splat for GFP_KERNEL
> (checkpatch should catch this)
>
> [1] https://lore.kernel.org/netdev/[email protected]/T/
>
> so just "return -ENOMEM" would be sufficient
>
>> +        return -ENOMEM;
>> +    }
>>       aux_dev->name = name;
>>       aux_dev->id = id;
>
> I didn't checked but having same code in two places raises questions.
> Are you overwriting old name here, or our code is just self similar?

2023-12-11 10:13:28

by Przemek Kitszel

[permalink] [raw]
Subject: Re: [PATCH] ice: Fix some null pointer dereference issues in ice_ptp.c

On 12/11/23 10:32, Kunwu Chan wrote:
> Thanks for your suggestion.
>
> I made the patch based on linux-next.git(tag:next-20231211).
>
> Our code is just self-similar, i didn't override the old name.
> I keep the logic as it was before.
> The newest code is:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/net/ethernet/intel/ice/ice_ptp.c#n2747
>
> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/drivers/net/ethernet/intel/ice/ice_ptp.c#n2993
>

sure, I just checked those, no huge benefit of dedup

> I'll update v2 patch with:
> 1. update suject prefix to "[PATCH v2 iwl-next]"
> 2. remove 'dev_err'
>
>
> Thanks again,
> Kunwu

Thank you too

>
> On 2023/12/11 15:15, Przemek Kitszel wrote:
>> On 12/11/23 07:26, Kunwu Chan wrote:
>>> devm_kasprintf() returns a pointer to dynamically allocated memory
>>> which can be NULL upon failure.
>>>
>>> Fixes: d938a8cca88a ("ice: Auxbus devices & driver for E822 TS")
>>> Cc: Kunwu Chan <[email protected]>
>>> Signed-off-by: Kunwu Chan <[email protected]>
>>
>> I would suggest adding "iwl-net" as a target here
>>
>>> ---
>>>   drivers/net/ethernet/intel/ice/ice_ptp.c | 6 ++++++
>>>   1 file changed, 6 insertions(+)
>>>
>>> diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c
>>> b/drivers/net/ethernet/intel/ice/ice_ptp.c
>>> index 1eddcbe89b0c..59794ce4f243 100644
>>> --- a/drivers/net/ethernet/intel/ice/ice_ptp.c
>>> +++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
>>> @@ -2668,6 +2668,8 @@ static int
>>> ice_ptp_register_auxbus_driver(struct ice_pf *pf)
>>>       name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
>>>                     pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
>>>                     ice_get_ptp_src_clock_index(&pf->hw));
>>> +    if (!name)
>>> +        return -ENOMEM;
>>>       aux_driver->name = name;
>>>       aux_driver->shutdown = ice_ptp_auxbus_shutdown;
>>> @@ -2929,6 +2931,10 @@ static int ice_ptp_create_auxbus_device(struct
>>> ice_pf *pf)
>>>       name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
>>>                     pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
>>>                     ice_get_ptp_src_clock_index(&pf->hw));
>>> +    if (!name) {
>>> +        dev_err(dev, "Failed to allocate memory\n");
>>
>> Kuba @ [1]:
>> no warnings on allocation failures, there will be a splat for GFP_KERNEL
>> (checkpatch should catch this)
>>
>> [1] https://lore.kernel.org/netdev/[email protected]/T/
>>
>> so just "return -ENOMEM" would be sufficient
>>
>>> +        return -ENOMEM;
>>> +    }
>>>       aux_dev->name = name;
>>>       aux_dev->id = id;
>>
>> I didn't checked but having same code in two places raises questions.
>> Are you overwriting old name here, or our code is just self similar?
>