Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 14 Nov 2022 21:07:05 -0800
From:   Jakub Kicinski <kuba@kernel.org>
To:     Daniil Tatianin <d-tatianin@yandex-team.ru>
Cc:     "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Paolo Abeni <pabeni@redhat.com>,
        Hao Chen <chenhao288@hisilicon.com>,
        Guangbin Huang <huangguangbin2@huawei.com>,
        Wolfram Sang <wsa+renesas@sang-engineering.com>,
        Marco Bonelli <marco@mebeim.net>, Tom Rix <trix@redhat.com>,
        Tonghao Zhang <xiangxia.m.yue@gmail.com>,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        lvc-project@linuxtesting.org, yc-core@yandex-team.ru
Subject: Re: [PATCH v1] net/ethtool/ioctl: ensure that we have phy ops
 before using them
Message-ID: <20221114210705.216996a9@kernel.org>
In-Reply-To: <20221114081532.3475625-1-d-tatianin@yandex-team.ru>
References: <20221114081532.3475625-1-d-tatianin@yandex-team.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Mon, 14 Nov 2022 11:15:32 +0300 Daniil Tatianin wrote:
> +	if (!(phydev && phy_ops && phy_ops->get_stats) &&
> +	    !ops->get_ethtool_phy_stats)

This condition is still complicated.

> +		return -EOPNOTSUPP;

The only way this crash can happen is if driver incorrectly returns
non-zero stats count but doesn't have a callback to read the stats.
So WARN_ON() would be in order here.

>  	if (!phydev && (!ops->get_ethtool_phy_stats || !ops->get_sset_count))
>  		return -EOPNOTSUPP;
>  
> @@ -2063,13 +2066,12 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
>  		if (!data)
>  			return -ENOMEM;
>  
> -		if (dev->phydev && !ops->get_ethtool_phy_stats &&
> -		    phy_ops && phy_ops->get_stats) {
> -			ret = phy_ops->get_stats(dev->phydev, &stats, data);
> +		if (ops->get_ethtool_phy_stats) {
> +			ops->get_ethtool_phy_stats(dev, &stats, data);
> +		} else {
> +			ret = phy_ops->get_stats(phydev, &stats, data);
>  			if (ret < 0)
>  				goto out;
> -		} else {
> -			ops->get_ethtool_phy_stats(dev, &stats, data);
>  		}

We can also clean up the pointless indentation of this code while at it.

How about something along these lines (completely untested, please
review, test and make your own):

diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 99272a67525c..ee04c388f4c9 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -2105,23 +2105,28 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
 
 	stats.n_stats = n_stats;
 
-	if (n_stats) {
-		data = vzalloc(array_size(n_stats, sizeof(u64)));
-		if (!data)
-			return -ENOMEM;
+	if (!n_stats) {
+		data = NULL;
+		goto copy_back;
+	}
 
-		if (phydev && !ops->get_ethtool_phy_stats &&
-		    phy_ops && phy_ops->get_stats) {
-			ret = phy_ops->get_stats(phydev, &stats, data);
-			if (ret < 0)
-				goto out;
-		} else {
-			ops->get_ethtool_phy_stats(dev, &stats, data);
-		}
+	data = vzalloc(array_size(n_stats, sizeof(u64)));
+	if (!data)
+		return -ENOMEM;
+
+	if (ops->get_ethtool_phy_stats) {
+		ops->get_ethtool_phy_stats(dev, &stats, data);
+	} else if (phydev && phy_ops && phy_ops->get_stats) {
+		ret = phy_ops->get_stats(phydev, &stats, data);
+		if (ret < 0)
+			goto out;
 	} else {
-		data = NULL;
+		WARN_ON_ONCE(1);
+		n_stats = 0;
+		stats.n_stats = 0;
 	}
 
+copy_back:
 	ret = -EFAULT;
 	if (copy_to_user(useraddr, &stats, sizeof(stats)))
 		goto out;