Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v2 1/1] net: check before dereferencing netdev_ops during
 busy poll
To:     Josh Elsasser <jelsasser@appneta.com>, davem@davemloft.net
Cc:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Eric Dumazet <edumazet@google.com>,
        Willem de Bruijn <willemb@google.com>,
        Alexander Potapenko <glider@google.com>,
        Cong Wang <xiyou.wangcong@gmail.com>,
        Vlad Yasevich <vyasevich@gmail.com>,
        =?UTF-8?Q?Michal_Kube=c4=8dek?= <mkubecek@suse.cz>,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20180313053248.13654-1-jelsasser@appneta.com>
 <20180313053248.13654-2-jelsasser@appneta.com>
From:   Eric Dumazet <eric.dumazet@gmail.com>
Message-ID: <1e992840-bf36-aa86-791e-8910a2aab7a5@gmail.com>
Date:   Mon, 12 Mar 2018 22:50:54 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.6.0
MIME-Version: 1.0
In-Reply-To: <20180313053248.13654-2-jelsasser@appneta.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


On 03/12/2018 10:32 PM, Josh Elsasser wrote:
> init_dummy_netdev() leaves its netdev_ops pointer zeroed. This leads
> to a NULL pointer dereference when sk_busy_loop fires against an iwlwifi
> wireless adapter and checks napi->dev->netdev_ops->ndo_busy_poll.
> 
> Avoid this by ensuring napi->dev->netdev_ops is valid before following
> the pointer, avoiding the following panic when busy polling on a dummy
> netdev:
>


> 
> Fixes: 060212928670 ("net: add low latency socket poll")
> Fixes: ce6aea93f751 ("net: network drivers no longer need to implement ndo_busy_poll()") - 4.9.y
> Signed-off-by: Josh Elsasser <jelsasser@appneta.com>
> ---
>   net/core/dev.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 8898618bf341..1f50c131ed15 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5042,7 +5042,10 @@ bool sk_busy_loop(struct sock *sk, int nonblock)
>   		goto out;
>   
>   	/* Note: ndo_busy_poll method is optional in linux-4.5 */
> -	busy_poll = napi->dev->netdev_ops->ndo_busy_poll;
> +	if (napi->dev->netdev_ops)
> +		busy_poll = napi->dev->netdev_ops->ndo_busy_poll;
> +	else
> +		busy_poll = NULL;
>   
>   	do {
>   		rc = 0;
> 
We could instead setup a non NULL netdev_ops pointer on these 'dummy' 
devices to not add a check in fast path, but I presume we do
not really care since this fix is for old kernels, and considering how 
long it took to discover this bug.

Reviewed-by: Eric Dumazet <edumazet@google.com>