Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 18 Apr 2023 09:15:33 +0300
From:   Ido Schimmel <idosch@nvidia.com>
To:     Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Cc:     mlxsw@nvidia.com, "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org,
        Natalia Petrova <n.petrova@fintech.ru>
Subject: Re: [PATCH net] mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
Message-ID: <ZD41hW/SVdNNqKRW@shredder>
References: <20230417120718.52325-1-n.zhandarovich@fintech.ru>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230417120718.52325-1-n.zhandarovich@fintech.ru>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?/plU99jFizc+PIE1+cKvcs+KiWQp961vyqKTWxWPcQawdy54+ArG5wLPIxra?=
 =?us-ascii?Q?vhRQ2YZcBKbEMPgW28fQumj8M5Ky25mZA4YrVw+EWPXOnc3AMZeoVwrhWSRs?=
 =?us-ascii?Q?7G1v5/cw62VEdMDpOMwVe/HrYhl3ZnAkZJOineQiwYwNgi85rxCGhx9PvMSQ?=
 =?us-ascii?Q?C3EjhcvnSwXEGtVlk2Frvq51AAHBU7qteBwpfhuHMgsYZnfqBp4nENHzbhWO?=
 =?us-ascii?Q?A+JRQce/kwY2O8vm0NNbDWhgNOZ/2FRdhiYJMMFE+ob1jFjz0N+PN+11AWzg?=
 =?us-ascii?Q?XAGnc/GxmCM+oLSDSvPH0NkWXR6f1QZopYmKuaZSDVr3pQXVJ8lAB4PsfxRp?=
 =?us-ascii?Q?LTRdnZl9Z3D+Ge4RvJGl9K1f2B5yxj/EPMWjW+8eOl6LrVJeoHU0rosnkn8d?=
 =?us-ascii?Q?cbb0k2YsEEOFJISiBM8uRpfvuTCGFfklaavOR++NtrVHH+cIKT5y909tw0kL?=
 =?us-ascii?Q?tfznh/BFehFVQBtuRqmF7h3csJb6UNtbRN/jlI6DRpJS7vBAxt3RR9Pf1Cjt?=
 =?us-ascii?Q?LN5LmY07PSW01+z848/K2Dv2J7+LDip9rBZaChwDMbBQWejh/5QiwRX+21xn?=
 =?us-ascii?Q?tP3XOrvN8AUEMN/7tjzlTUv/U/ck84wNA9bI2pirC+z/0bds4b7RK0yE2Gde?=
 =?us-ascii?Q?HFt/AqFQHDTbLR+QElkccfchfteVyDI+BdSoWh1i6dN4gahsfuL755r0Nyxx?=
 =?us-ascii?Q?ypsqtSvyhiK+0g9gNN6cTmgZaDJlCrvuaSZnYpt4Pv5WrgbAqga5esX+7DaX?=
 =?us-ascii?Q?UY81FiyH2L9GOKp+viWXsuUag9/fP2C1QfmnzR0qQOydljf8sXhXiY0LUiq3?=
 =?us-ascii?Q?skhyXOKnRoAtmwjTv8Cvwgkd5E6FFtvoOZ9gQ/8172vPr3dN3IeXFjKhh7xs?=
 =?us-ascii?Q?tFNUNAAU/DAg04x2IchSN/dLDUcW3F68tuVDh3HSwuTCcvPNcFLvmyL32RVq?=
 =?us-ascii?Q?8qn0p2+p3/JnusGEUUmcUT3R9qNcTVQiNYJxjn97I9riEoCfDm3W2JthTJqj?=
 =?us-ascii?Q?2zdt7fUA7sOfFw1vkefF8kuCA6BJJXkTScLtFCur5crQjNez3cJMR1OjWhw7?=
 =?us-ascii?Q?BzUOGaK7JIPb4WusMamvzoC627NkHSUnmBUQNalv8h6qehGY2CE5XWzLr9x3?=
 =?us-ascii?Q?kNNl1h+76ERt2IXmpJQ7EdZfonSUo29OeJQGUDrH8jcs+jCmSoBFa9g7ujEZ?=
 =?us-ascii?Q?pyBWfqag2R8bvTfNQdlkumyja1Wy/2Z/what9mjFSqcvR1KjpC0ydP/VXD3r?=
 =?us-ascii?Q?5IBBCd0/UmM2vy4zES0cqbBnwhVglQzZHHXDLLqmaFNUoL+Mde15Gx7AtjmH?=
 =?us-ascii?Q?U2x137R1lxR/WCqnGVQJK8XJhRtmNi8C4+xVBzH/5fpN7IWZyCt/odw5ykcT?=
 =?us-ascii?Q?J5al/drlyAls5JNVjvLEMRHOMz7WTzAQHv2kbRE6IH1+aleYnv2dJRI4/ziM?=
 =?us-ascii?Q?Lv9bzZmUdAYON5/Dm7/+54K5lCW6mUsNGT56qaTSKXEABhdHCP1LmNF/0zOm?=
 =?us-ascii?Q?Td1h6Ze4J4EFX54IPENeA0bZhUtgpcf0ulw4CcZLJLntUmyq1K5TegWwKzLr?=
 =?us-ascii?Q?wZmimsswzRG7X3NJAsSq7sWl2PRlEqCBoUhNJNX/?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6c67b31d-7091-4b80-2b30-08db3fd454ac
X-MS-Exchange-CrossTenant-AuthSource: CY5PR12MB6179.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Apr 2023 06:15:39.5260
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: NZak4cl5XtRV6kAxmGqISfmdM+ZN/aLpL82aFljGmtB4XHgEs7DbVkR2m7CsIKIFyk1Pxa5h0Mey5Pb6mvm/1w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR12MB7337
X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=no autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Apr 17, 2023 at 05:07:18AM -0700, Nikita Zhandarovich wrote:
> Function mlxfw_mfa2_tlv_multi_get() returns NULL if 'tlv' in
> question does not pass checks in mlxfw_mfa2_tlv_payload_get(). This
> behaviour may lead to NULL pointer dereference in 'multi->total_len'.
> Fix this issue by testing mlxfw_mfa2_tlv_multi_get()'s return value
> against NULL.
> 
> Found by Linux Verification Center (linuxtesting.org) with static
> analysis tool SVACE.
> 
> Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process")
> Co-developed-by: Natalia Petrova <n.petrova@fintech.ru>
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>