Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   wei.fang@nxp.com
To:     davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, xiaoning.wang@nxp.com, shenwei.wang@nxp.com,
        linux-imx@nxp.com
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH net] net: fec: Coverity issue: Dereference null return value
Date:   Thu, 15 Dec 2022 17:11:49 +0800
Message-Id: <20221215091149.936369-1-wei.fang@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?7Rzcg5ziGOYQMDnR0ZoGY53YVfA42qdnC8vas0qGjMCZnWx3eyY1kU7AxwS+?=
 =?us-ascii?Q?AkmY/GPeH9nHEz6uDELBgBB+C+33cyyNm3IRRyUVilGG4ELmMLhZYw3ngMQZ?=
 =?us-ascii?Q?XOIOqfAqnPQTd1Py9VoAVp1ZFI00opRAj7O132QTUvy1CFTgotZvheHJ4No1?=
 =?us-ascii?Q?hOxRbXwM8gcofN9CkR6O2it0vZzFOhmj5cwrE9pPoczppkJ3ziMs+iCr7ypn?=
 =?us-ascii?Q?GxquEx3YCoEjPAXP9G6Lc2pQgKYbY5am4sUd8/RAs9mJNGIAqcuyWexRDV3J?=
 =?us-ascii?Q?EmAemX64hJDULQIT192AfUmeCuz7t3CvxYdNf7MtzgurTkUq7x8iZcYvV44x?=
 =?us-ascii?Q?k/N/HFSgNFfjCjVZa3d6y8dzvr+rNV1TcIfKpo464kN0p8+TExJOHTtHTTD+?=
 =?us-ascii?Q?wiwT2xqaPTvLKKOJZ1qys+CxeZGOFWyrbVlM0JdtIbHA+nYpAV1W3PjMT0s7?=
 =?us-ascii?Q?A8ccD11zi5JO3/iE1vSsxOrCRbUdZ2vBbxZ4QXjYTRq9207NKKf/v4edQml7?=
 =?us-ascii?Q?iNBxwkuFV53QQhbpRj9uz2I8Zc7o1GUojiMOGBtmp0tSJkFtK+Kzlk8W6H+0?=
 =?us-ascii?Q?Lrkoa3gF9xVc++Y7mJo6p7y4ug6QsjT3VH/PHEYzWNa+4sQFNyvxsywuJ5VT?=
 =?us-ascii?Q?tXU552t+xZEOz26rK/UFhWtIoMzfxiWEr5HH7cKHfXZW/rV42bWdOKOEs2O4?=
 =?us-ascii?Q?9PT6aBLRku4S2RF/gSNkCDgYhCPlwo9SOrtgJUa9+5V1CF1EEZjzoQr19ZDE?=
 =?us-ascii?Q?gJElKeSl5K6mh30dp6UNtTd7PC9OZE0w3jsrElmegsCklxepIaIFPjQEw/jW?=
 =?us-ascii?Q?dYo97NNdlAKfEaTpltOm9cVVx4bt83/Fs7RdFGVp3WMss7bJJxMmdd87HFQN?=
 =?us-ascii?Q?HwOTX76HGKHwWJo8THK9NWGKrMYkubqWOurTQmhf7gBObbbKxIg8+zRVLMhg?=
 =?us-ascii?Q?aC4/vvoX7/6SJs1uuoYt3icEheTXUjyQcuJcbxUQWu3Eel4anZByJnrJRX25?=
 =?us-ascii?Q?XirNuAvgAauzwwS79utbVrj4jd+HgXRnepOK6cZmKg44KJhu8c8+8yUIfS8q?=
 =?us-ascii?Q?1MhLoipognKwLjnyR04j4g3G9AUVEQBUwcPK/toRVXRyRwsUbkVwing0tFQt?=
 =?us-ascii?Q?L3id0Yc3XZizg5QYLanrtToNSfK5/5Fhdkmhizb5azrwuLIpByxvBMaWHzwG?=
 =?us-ascii?Q?tVAWBISxlNDaJVY0FdlDMkjXNR8l2HsodqLWqbWjldDjCr83gqsepsE/CJ1n?=
 =?us-ascii?Q?cShLMj8S43VYsKdUuTeliZabpnFDugd6oVYvoEfythG9fMm3AFNkp+vYJ6KY?=
 =?us-ascii?Q?vmn4jjAhDAIA37KDg7FulHGVFyJXEUMUaWcKnbOBBj91jNcb9Ne5mtQIamxC?=
 =?us-ascii?Q?i5/HlIk4h72uEw/B0rNIOgMrs3z5CmM4tXg5tMWP1+bjULnnmU155oCKrVNE?=
 =?us-ascii?Q?YngLtAYGd9Qhxu8zDqtmgEDz/N4sAY3J2TGybZm4knIIGXPLC+nxqMemOqfO?=
 =?us-ascii?Q?F/VvYIhoFkdcS1dmd13h+ejfX89ENO97S++v3aRfurQimTIbBPdIWJk6RxbR?=
 =?us-ascii?Q?Cqbl/lNKcFzOfe5Rfbfhy9H93TLkyEgqKWGuk8Sy?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4b127f74-0206-43ab-427a-08dade7cdebc
X-MS-Exchange-CrossTenant-AuthSource: DB9PR04MB8106.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Dec 2022 09:15:14.2420
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: gwcl3mgOmC6O8+88Yi+UKxW4j/ikpbEA/0/aGEKX5KWh6S/efN+FNmTv5t1BpJ4uQ46usB4ESRpeawYnQiwIRg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB8609
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Wei Fang <wei.fang@nxp.com>

The build_skb might return a null pointer but there is no check on the
return value in the fec_enet_rx_queue(). So a null pointer dereference
might occur. To avoid this, we check the return value of build_skb. If
the return value is a null pointer, the driver will recycle the page and
update the statistic of ndev. Then jump to rx_processing_done to clear
the status flags of the BD so that the hardware can recycle the BD.

Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Shenwei Wang <Shenwei.wang@nxp.com>
---
 drivers/net/ethernet/freescale/fec_main.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 5528b0af82ae..c78aaa780983 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1674,6 +1674,16 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
 		 * bridging applications.
 		 */
 		skb = build_skb(page_address(page), PAGE_SIZE);
+		if (unlikely(!skb)) {
+			page_pool_recycle_direct(rxq->page_pool, page);
+			ndev->stats.rx_packets--;
+			ndev->stats.rx_bytes -= pkt_len;
+			ndev->stats.rx_dropped++;
+
+			netdev_err(ndev, "build_skb failed!\n");
+			goto rx_processing_done;
+		}
+
 		skb_reserve(skb, data_start);
 		skb_put(skb, pkt_len - sub_len);
 		skb_mark_for_recycle(skb);
-- 
2.25.1