Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   wei.fang@nxp.com
To:     davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, xiaoning.wang@nxp.com, shenwei.wang@nxp.com,
        alexander.duyck@gmail.com, linux-imx@nxp.com
Cc:     netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH V2 net] net: fec: Coverity issue: Dereference null return value
Date:   Mon, 19 Dec 2022 10:27:55 +0800
Message-Id: <20221219022755.1047573-1-wei.fang@nxp.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?cnQmNGwOYu9USZms0qpJX6Wm53uuFGPu3o77s/yYPJ1dOq7TN0DD6H33/8kz?=
 =?us-ascii?Q?WbIg5geW91Ej38L317JzZNMeuNUYNHffqBUVWn/NvzHo+T1MECtKv7FWvkT7?=
 =?us-ascii?Q?Id1u+GX1KK6v7K7yJ9RrG7W3YnJdjWGBE5jyO2d1rPFzveX2oTgZ8if8ExOU?=
 =?us-ascii?Q?EZwrzSK5hQBHitUdUY547K8cHY3esaOamZRBTkqtTSUjEaM3xZtNH3sQPIye?=
 =?us-ascii?Q?m6M6/L53uN4nmp8ZEy/xplIpXphy7XmYW7KRVk0T5P1RWuUnKpbAVD0tjn88?=
 =?us-ascii?Q?0nsovAG0f53uAAKhzJI639pPzlNTu3kZVrIGzapHFjsi3efREfXAfbW7B1A2?=
 =?us-ascii?Q?Gz0doJPQNnytfpKYU9CDLFwhhDNobNrbUotRDSchupe7NGByfjB3b9dn19K6?=
 =?us-ascii?Q?lyy1aYop1g7xJpjpG8XTtPFF6lByZLvzmrw+cTcTRDk8YevHJNFfk8BtrFHy?=
 =?us-ascii?Q?iWL/VoBSUVTceUHgW0FfW4Ds8oEFbbF5E2osPk0nTm9/O3NFTtxJnZ3yexOg?=
 =?us-ascii?Q?mQmly5Sr21W2Gmv3ZAPlaeSlpZw5CBdtNnnpGc/xm/cCViaOek3kfcyT3rl0?=
 =?us-ascii?Q?pPkdYWp/yR8RNqggA33xrCaAUEZJJF1vWij2P3rUKSrhK5Cu4hmcTAg7E2U2?=
 =?us-ascii?Q?knGzFooXgJkdaaJNGMjft71/z0HWv2Qarthtyd//vj++Xf2AAC8YPPKO78Vg?=
 =?us-ascii?Q?vgbEWgZ1TGu1p7C4uoZtsKv+HoT5HrEmWQdetEZ/S3fSnqt/2vgfVwzk1cJJ?=
 =?us-ascii?Q?iX143Y5E+Ty+CtfSIGgbSyNlmKWgLLVfGaLcGB5LnnYpnoeY3DSus8xvYrvi?=
 =?us-ascii?Q?E0FqaVGqTZgnJu3YSHdNlGcNOnfj+YGeu9o1Dw+r1jabJ5s79zIRjW7fOXvg?=
 =?us-ascii?Q?hKssILe/iRHA+8aC5Um0zjD+aQu+o0JEtRbFeG+fauwhawcs6o/miSs1DF36?=
 =?us-ascii?Q?nmQYJOIc2suTl8ouUv1KmbrD0TLmni2Zpof+7KLSqHdmC0p1iwVi9ilv+Urs?=
 =?us-ascii?Q?EGUV9K/KhEBfVGjHufN5LkMCryn65IddcbYNEb/vhwqW6P1Od7dt4MxOClKN?=
 =?us-ascii?Q?VQYYUXm9gJqv4QAUk/xtbXR3SsvTE8X8q1Y1s/FpojkrbWReNkaGUWl+JtjV?=
 =?us-ascii?Q?8Yz+G22isUJVMitHV6zloGDldKr2XMX1MW9mndd7AcIKzj9Puk0TvCdnB8sA?=
 =?us-ascii?Q?Bsy1sKUJZr2IAGWNOPUWXHlh6He8jkFmJHrs10zq5gsvlsCxSCvCyL9Ng+Tm?=
 =?us-ascii?Q?pvAuiMeOLFzbpopmkin5XQtx9wgJehgWO1RUVNHNIF2wnzes3xRj+/C+hRVm?=
 =?us-ascii?Q?4oDT0ILUqklAa/9C7VoDM8LJjLPQzIBIhXW4nlaWlrmq566E0rrq7qR4rKdR?=
 =?us-ascii?Q?kQTEC2eoG4sHZs3V1DtPYdwy3xgHTK8m1snUpf8UlHpxxnUUFsDQojkfALbi?=
 =?us-ascii?Q?f+wGLpb2D6IHJtLq9BdV+JUNkvLIwMbR3T2n4Famjhvsj+5OjEXFvpJZ+N0Z?=
 =?us-ascii?Q?rBX+AUrH5Ii0CdNfkDqW8wfoOM4ApEugn5mhJcFjML3ydP+bd8cTQkpWw4JN?=
 =?us-ascii?Q?YZx3jYgj4lMn5S0AaQGvtUtarmYJNh+t4LpZG/dL?=
X-OriginatorOrg: nxp.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f9049480-6be3-49b1-a9a3-08dae1691e1d
X-MS-Exchange-CrossTenant-AuthSource: DB9PR04MB8106.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Dec 2022 02:31:22.1296
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: n3Ke2uQMzzfiAgeWaRX/KWgq1Xlymv6PtdlkvDCexULYoJ4cpNyXWIDY3gVmzS4ixz/nJBCQC3qOdDNi/PiuuQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR04MB6953
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Wei Fang <wei.fang@nxp.com>

The build_skb might return a null pointer but there is no check on the
return value in the fec_enet_rx_queue(). So a null pointer dereference
might occur. To avoid this, we check the return value of build_skb. If
the return value is a null pointer, the driver will recycle the page and
update the statistic of ndev. Then jump to rx_processing_done to clear
the status flags of the BD so that the hardware can recycle the BD.

Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Shenwei Wang <Shenwei.wang@nxp.com>
---
V2 changes:
1. Remove rx_packets and rx_bytes counters.
2. Use netdev_err_once instead of netdev_err.
---
 drivers/net/ethernet/freescale/fec_main.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 5528b0af82ae..644f3c963730 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1674,6 +1674,14 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
 		 * bridging applications.
 		 */
 		skb = build_skb(page_address(page), PAGE_SIZE);
+		if (unlikely(!skb)) {
+			page_pool_recycle_direct(rxq->page_pool, page);
+			ndev->stats.rx_dropped++;
+
+			netdev_err_once(ndev, "build_skb failed!\n");
+			goto rx_processing_done;
+		}
+
 		skb_reserve(skb, data_start);
 		skb_put(skb, pkt_len - sub_len);
 		skb_mark_for_recycle(skb);
-- 
2.25.1