Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
Message-ID: <b377a7c1-bf41-4fd2-81b9-ace2b6134c4e@suse.com>
Date:   Mon, 6 Nov 2023 13:59:08 +0100
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] net: usbnet: Fix potential NULL pointer dereference
Content-Language: en-US
To:     Ren Mingshuai <renmingshuai@huawei.com>, kuba@kernel.org,
        =?UTF-8?Q?Bj=C3=B8rn_Mork?= <bjorn@mork.no>
Cc:     caowangbao@huawei.com, davem@davemloft.net, khlebnikov@openvz.org,
        liaichun@huawei.com, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org, oneukum@suse.com, yanan@huawei.com
References: <20231101213832.77bd657b@kernel.org>
 <20231102090630.938759-1-renmingshuai@huawei.com>
From:   Oliver Neukum <oneukum@suse.com>
In-Reply-To: <20231102090630.938759-1-renmingshuai@huawei.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Zk5zUDJ3c2F6bFZjazRMcUx2RFJacnlOQ29wSFBoSW5kbzJ2bzBqbHE4ZzEy?=
 =?utf-8?B?ZWhjZ3hhL2M3R0ZwM3I4U2tyWkZubDFhRWFVRVIzbDBJRnRJRzNOVDI2ZTJN?=
 =?utf-8?B?YU5zWjNUTVlnQUR5Yk9XRFpaUWVXalBXUVNKNncydG5UMENZUC9RLzgySDRk?=
 =?utf-8?B?M3pqeExwbHloY1hDVGdYTm1ZRzJ1bHhpMWFJbi9NZ05nY095S0hING9UMlJE?=
 =?utf-8?B?blRKQzZOMjY4R2ZqTVpxdUdkSnVNSFJyeWwzRGc5NkhUZk92L2FrUEcrNFJt?=
 =?utf-8?B?NVd0VUtGYitNN0dIMFloanl0cXZjRDBFeVErc2J6WkZMZ3RJcmc1QmFZS2xP?=
 =?utf-8?B?VFJCdWFocm14N3dOaGRWZlJTWGFsVkRGOWl6ZVZTSHpwY25mdUg3cnkxOXdi?=
 =?utf-8?B?RS9oOFdTZHJFM0dUVVhHK2JhRnBwSEhGaUJCeDhUSW42akdFUzdHM2EvQncv?=
 =?utf-8?B?Ritic3FRR0FvV2ZNbVhaNm80bkVHbmNFWk1WWTd3UVR4NTlPYS9WbzZ0dDVB?=
 =?utf-8?B?Unk0MThKZ3FlbWx4UjR1V1NFcW1uQnNoMFY3NWlTV2FsZmx4SERHM0h6ckRv?=
 =?utf-8?B?a2EycDNNR25GT1U5ZGRNNUhoa25XdXVuZ1Z0c2xIOEg2ZC9rcWdiSHVleitS?=
 =?utf-8?B?SHBKeERWM2taYUd2TEszR1pKWDQwWklhM0V1WDRqaml0R0ZmK0ZiaGdNbXor?=
 =?utf-8?B?cTBVMzVUYmNGMlNaUW9xTzd3ZHlVSmJ2YkNrY2QvQWZkVGsyempodjdZWlRo?=
 =?utf-8?B?OC9nQmFQcGh3VmtSU0VFQ1RDRjhMWU9LWUtKQVdSWDZQcXhFdE9DWjgyTVZ4?=
 =?utf-8?B?ajV1UkNFQ2JqV0ZxV2N5M3lHVXV2eThaNkczcjVJb05DVjVuWmw3ektHdkVy?=
 =?utf-8?B?emZueXZ5cjhUZmN5bVcwVjlWaTJ5VUhrMnNMRnAxelF3RGxqZW45NVEwQzhw?=
 =?utf-8?B?Y0EvMmMxRVBCVTBkcDFDY3RBemdVM3pXZHFIaFRYVEFEMndlR1VMbDdZeVlK?=
 =?utf-8?B?MHZLcWhBeDRqbFUyMDNwKzFteFFNS1pabG9pZ01zdFVWaThnbU5FTVdYbU9S?=
 =?utf-8?B?SFU2ZXQxSnFJMWtXb29xOEVNc2xhTVU3Y2VoSzg0L0ZGNFJHSWRvUlVGNE5q?=
 =?utf-8?B?R3hVTkR0S0x6L3FKMGJwY3gzTXVxUVZjNXVtdFdia0ZqTnpWM0NlU2l2TkFa?=
 =?utf-8?B?RkQrNTFITUF3MmJRQkNHdW0wbEtYbkNSSi9ZR2tMTEdsUlYwN1VVK2xCUTJB?=
 =?utf-8?B?YzdGRmUxRXdXUGFGZ281Sk9YbXV1emRieks3QW1sdEFZVkcrQzg1WUNwZk4v?=
 =?utf-8?B?cUV4U2liNUNvOGpwVVlCK1llZ2ZLZDJYYWwrd2k2eHJMNWl3TzRqVis3SjNE?=
 =?utf-8?B?OVpRbkNBQ25HbXg4OXBrdjkwSExMQmsxNmJsVFM0WVFRMWNja243WGdnOFFI?=
 =?utf-8?B?QUZycW5kTkQ5TXBMbTBGTVgrR1JlUVlHTVpjVUNOOTg5aG5CWlZ1MmVDQ1JT?=
 =?utf-8?B?SWI0YzhEVWVsREt2Z2hTT0JjWmtYd3RiN2xXSkNrNXNYalZLb0t5UXNMRW94?=
 =?utf-8?B?UlRXQVkrdVNkcXRkZmNJVkVaQk1HQ00vRXBZRFplRlA5bnZEM0lRdVBPL2RX?=
 =?utf-8?B?RU8wcHY4cFhSbUhUeVNuZG5FcVp4WEIvYWVyZWwwUCtMZDA2eS9GZmRtOGlC?=
 =?utf-8?B?Z2YzTm5keStiOGJhaFV2YTNkZzlDcFdWblJpYVNGZVpLOEJNa1dncGNUa0FX?=
 =?utf-8?B?NENiU20rOE9kdFRXTVAvK24wR3FPaHptS2hJeUNFc2lQWUR3ZHFiVExHOUc2?=
 =?utf-8?B?YWlhRDI0V1BQdDNRK3B3aXBaVlJHNmUvbERsYXB2MEw5LzJ3aVU0TzdHeHFO?=
 =?utf-8?B?aW5aeUxRQUpXVjhua29SVENpYXpjUzlQZkR2K05uT3JOUU5IQnB6cFhUN2Fa?=
 =?utf-8?B?azhFS0lEc1MweDZFbDd1Q1YrTkw4VmZ3YkZJWXA5QmluYS9KdXdNRndESDVu?=
 =?utf-8?B?eEtCbjZJZzhBdGVHcUJtaWo0ZTJqaDkrSDBjaWFlRjlYMU13KzlvU3pOMVBx?=
 =?utf-8?B?VWhLbkt1d0V2QTFpcG15L01JTXYwMUZQQ2NRRVE5M2RrbXdHWmw2SmY3bDNG?=
 =?utf-8?B?WjdrQ2ptdHBCWGhvdmViQWg3U0VtcG5KdmhTcXhiNkM5emdpZVlJa2VLSW1n?=
 =?utf-8?Q?857UEHUHLDw9f+ZoNzfjt6RMt7t4mHcSmG5TaH8vt3CP?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0397ad27-0b9c-49a5-9461-08dbdec82b21
X-MS-Exchange-CrossTenant-AuthSource: AM0PR04MB6467.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Nov 2023 12:59:10.2566
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: G9X42B0zUI8agHMsLB5K14LnYmHKO+S/qY+NTdB1Y6vaaFZR4fTGLTE+4kdmM9c/J8T2TOsI24kddNV/me6aHQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB9190
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Mon, 06 Nov 2023 04:59:19 -0800 (PST)

On 02.11.23 10:06, Ren Mingshuai wrote:

>> What do you mean? Grepping the function name shows call sites with NULL getting passed as skb.

You may see that we do check skb != NULL before we timestamp it.
But later in the process we depend skb == NULL implying that tx_fixup != NULL

That is the combination that must not happen. If it happens, though
simply bailing out seems to the wrong answer.
  
> Yes And I just learned that during the cdc_ncm_driver.probe, it is possible to pass a NULL SKB to usbnet_start_xmit().

How can that happen? And if it happens is tx_fixup set?

	Regards
		Oliver