Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 25 Nov 2022 14:30:54 +0100
From:   Maciej Fijalkowski <maciej.fijalkowski@intel.com>
To:     Yuri Karpov <YKarpov@ispras.ru>
CC:     "David S . Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, <netdev@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>, <lvc-project@linuxtesting.org>
Subject: Re: [PATCH] net: ethernet: nixge: fix NULL dereference
Message-ID: <Y4DDjquBK8upTxs0@boxer>
References: <20221124084303.2075092-1-YKarpov@ispras.ru>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20221124084303.2075092-1-YKarpov@ispras.ru>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?TE3hxhRMcfQKiiGF2n5b7xtHq44cTQwSZblmNtZynlFuf8PthGm7v2Pt4ChL?=
 =?us-ascii?Q?Ol0QW4wQjGV1uOum05zgn9Ign78Dnc042z5mMQ3cQcnDvNrckbnzIM2pt7i1?=
 =?us-ascii?Q?Q+4ltcvWRd12n66vbFQ2kXj95hoyViOB3B/nW1AWAJO0Ylb01urSCUv/bMRS?=
 =?us-ascii?Q?uzNfIgd3xcHlk/ECdv0iltUhLMbOCcno3dPGb5Vy8pd90tQhaIoQofQtWLd1?=
 =?us-ascii?Q?yC14nSmRS2U0BC6riwJ+u1HfdY9IebAa8HjqDbn5jyJqqTD73pxJk0l0eMwS?=
 =?us-ascii?Q?BN5TA8lNd1fL+ysZ6BFBJbj2dcqotY1O41Ydt1OYAtzpc5moRiye9ZgoIhbb?=
 =?us-ascii?Q?WYRRr20lvkhN04QzX+l+4yGvCkSMJxpp+l/jPPeICCZtWWsjnh3OplXKuT5D?=
 =?us-ascii?Q?P2nKmFmPDTGu2JSYnVM7ANbzgyN9jfe+7lnX0OkB+jmscfteg3b0KRPjQRJF?=
 =?us-ascii?Q?CzWf3ebVTVMoFrhebOpC6ZcYB5QWqa7o/3NFoM28ysrnB2KTirAOLaamIHU6?=
 =?us-ascii?Q?y5zKrbpPKaizJJ8EERITa+fPapVtlNm3nw6tGmv3BHj8K3vKTxYNlnZbCd0j?=
 =?us-ascii?Q?GSWndydQD2P24TS/xFZYbZpFJ6pvYlRojXrtxhu/f2JGiBWgXhIe9nPc7JDV?=
 =?us-ascii?Q?M32jp0Vtxb1iYGXVtnGHzrCB7VNM1xFZpc/XHu6f7qYnBLFlhMbbPn+aV0hc?=
 =?us-ascii?Q?Uv6W1s6igDZXksOKoNUL2o2Qln0q7nd3TtDj5g8aMF7MDhDo2vt9lyccX1Hj?=
 =?us-ascii?Q?w+CueCelfLzwKq7bUkCHg/qhnjkXhew03vQijMfRhW/fOK093RfRohCd+Lrd?=
 =?us-ascii?Q?JeVdCVbtNDUPAn3RodOJxCdLtlhHSIcKirb/LoqW3MXEIyb9q1DrmWz3cakH?=
 =?us-ascii?Q?lliRLDKvZ/0KOkLtO7+PDJlkAk8Kv8avuNGQaMbMlmCCKdwjezWrNVE1DP0H?=
 =?us-ascii?Q?paWFJi3K1SoeKcs5yY/2fZTeHEiVBCQadCKhZS4IRbxnXTxXYq0UvBMYhqdB?=
 =?us-ascii?Q?+/XMJMBc7sTkL3xk2vFev9CVcnY51k2ZuUHUMv3Oabz8hQ265waYRHqs8RmY?=
 =?us-ascii?Q?V4oa5bggzrS5R71RnF0Rr0heQ6CmtMyqzxFb3u3Pas1rkyTwrrFgsGRqfSAC?=
 =?us-ascii?Q?HXAO2lLCA13evclhRLjtYJtYE7mI7OPOhYyKDU1Q7alDr7OLGs5Tvb1A6xZd?=
 =?us-ascii?Q?4J2d2bB2K/FmqrpE5yZuzi8on1N5gEVNIAPC5CcW7g/+X0FDr3F8+k4ObfzT?=
 =?us-ascii?Q?9wXFsx3tCO75m5IntsaCbO0D/sSUIh32+Lqs6FTb/2dvLHx7AYHq6z/W3hpT?=
 =?us-ascii?Q?pi97sqpS6uH7obGvbZbXaD0v0+9eV4rJFJK5oOnCB0+xfouA0CTSyKPFGMyh?=
 =?us-ascii?Q?8v7auJ5lVvSGglsFUMKMcih0vxGfo8I8gL9XTrZMa4upvsRvzylzQ77pOtoD?=
 =?us-ascii?Q?qeuSnseiM4wT2eJ+BWLLKrUiGVXOcv/1akywU7IIdT37UJ3Newfg39O7Q6LS?=
 =?us-ascii?Q?HP6ixLrGxdZDztuW9tzT0lzVHx1DxA62tc5hkVbkqN93qbRMmosFgcFakim3?=
 =?us-ascii?Q?bHfioOiQp1rs8byexgppU0yQlRL4bPCY++1ka9csT9qLnjDREf5EIyQmrp2k?=
 =?us-ascii?Q?EA=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 3ecd16fd-78ef-4e0f-55f3-08dacee94ad7
X-MS-Exchange-CrossTenant-AuthSource: DM4PR11MB6117.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Nov 2022 13:31:00.5924
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 6DIhrOPhiwn3TVAlQlMkYHr41YPw/j7IGn+hw+gK87ixal3y/Aw04piGsOz45Lk1C7nuEpYYBTLRdyDANRu2cHSSt78MmwWbzpv1Gksc7o0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR11MB5154
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Nov 24, 2022 at 11:43:03AM +0300, Yuri Karpov wrote:
> In function nixge_hw_dma_bd_release() dereference of NULL pointer
> priv->rx_bd_v is possible for the case of its allocation failure in
> nixge_hw_dma_bd_init().
> 
> Move for() loop with priv->rx_bd_v dereference under the check for
> its validity.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev")
> Signed-off-by: Yuri Karpov <YKarpov@ispras.ru>

Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>

> ---
>  drivers/net/ethernet/ni/nixge.c | 29 +++++++++++++++--------------
>  1 file changed, 15 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c
> index 19d043b593cc..62320be4de5a 100644
> --- a/drivers/net/ethernet/ni/nixge.c
> +++ b/drivers/net/ethernet/ni/nixge.c
> @@ -249,25 +249,26 @@ static void nixge_hw_dma_bd_release(struct net_device *ndev)
>  	struct sk_buff *skb;
>  	int i;
>  
> -	for (i = 0; i < RX_BD_NUM; i++) {
> -		phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i],
> -						     phys);
> -
> -		dma_unmap_single(ndev->dev.parent, phys_addr,
> -				 NIXGE_MAX_JUMBO_FRAME_SIZE,
> -				 DMA_FROM_DEVICE);
> -
> -		skb = (struct sk_buff *)(uintptr_t)
> -			nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i],
> -						 sw_id_offset);
> -		dev_kfree_skb(skb);
> -	}
> +	if (priv->rx_bd_v) {
> +		for (i = 0; i < RX_BD_NUM; i++) {
> +			phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i],
> +							     phys);
> +
> +			dma_unmap_single(ndev->dev.parent, phys_addr,
> +					 NIXGE_MAX_JUMBO_FRAME_SIZE,
> +					 DMA_FROM_DEVICE);
> +
> +			skb = (struct sk_buff *)(uintptr_t)
> +				nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i],
> +							 sw_id_offset);
> +			dev_kfree_skb(skb);
> +		}
>  
> -	if (priv->rx_bd_v)
>  		dma_free_coherent(ndev->dev.parent,
>  				  sizeof(*priv->rx_bd_v) * RX_BD_NUM,
>  				  priv->rx_bd_v,
>  				  priv->rx_bd_p);
> +	}
>  
>  	if (priv->tx_skb)
>  		devm_kfree(ndev->dev.parent, priv->tx_skb);
> -- 
> 2.34.1
>