Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
MIME-Version: 1.0
References: <20231204085810.1681386-1-daniil31415it@gmail.com> <08ae0a18-669e-b479-94d4-450a7a12efe9@marvell.com>
In-Reply-To: <08ae0a18-669e-b479-94d4-450a7a12efe9@marvell.com>
From:   =?UTF-8?B?0JTQsNC90LjQuNC7INCc0LDQutGB0LjQvNC+0LI=?= 
        <daniil31415it@gmail.com>
Date:   Wed, 6 Dec 2023 13:15:24 +0300
Message-ID: <CABAdP+SHe5XhFVjUauWRoEgGELHm98G=Or+m9V7Lw_rZ57oQ2g@mail.gmail.com>
Subject: Re: [EXT] [PATCH] net: atlantic: Fix NULL dereference of skb pointer in
To:     Igor Russkikh <irusskikh@marvell.com>
Cc:     "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Richard Cochran <richardcochran@gmail.com>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Jesper Dangaard Brouer <hawk@kernel.org>,
        John Fastabend <john.fastabend@gmail.com>,
        Taehee Yoo <ap420073@gmail.com>,
        Alexey Khoroshilov <khoroshilov@ispras.ru>,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        bpf@vger.kernel.org, lvc-project@linuxtesting.org,
        Egor Pomozov <epomozov@marvell.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

I am sorry for breaking the mailing list and sending my answer only to
Igor, I've never used emails that much. To make it clear, the answer
was: "Hi Igor! No, it hasn't been reproduced in reality because I
don't have any appropriate device."


=D0=BF=D0=BD, 4 =D0=B4=D0=B5=D0=BA. 2023=E2=80=AF=D0=B3. =D0=B2 19:06, Igor=
 Russkikh <irusskikh@marvell.com>:
>
>
> Hi Daniil,
>
> > If is_ptp_ring =3D=3D true in the loop of __aq_ring_xdp_clean function,
> > then a timestamp is stored from a packet in a field of skb object,
> > which is not allocated at the moment of the call (skb =3D=3D NULL).
> >
> > Generalize aq_ptp_extract_ts and other affected functions so they don't
> > work with struct sk_buff*, but with struct skb_shared_hwtstamps*.
> >
> > Found by Linux Verification Center (linuxtesting.org) with SVACE
>
> Thanks for finding this and working on this.
>
> Have you reproduced it in wild, or this just comes out of static analysis=
?
>
> I'm asking because looking into the flow you described - it looks like XD=
P
> mode should immediately fail with null pointer access on any rx traffic.
> But that was never reported.
>
> I will try to debug and validate the fix, but this may take some time.
>
> So for now
>
> Reviewed-by: Igor Russkikh <irusskikh@marvell.com>
>
>
> Thanks
>   Igor