linux-kernel - [PATCH net] be2net: check wrb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251112092051.851163-1-a.vatoropin@crpt.ru>
Date: Wed, 12 Nov 2025 09:21:04 +0000
From: Ваторопин Андрей
	<a.vatoropin@...t.ru>
To: Ajit Khaparde <ajit.khaparde@...adcom.com>
CC: Ваторопин Андрей
	<a.vatoropin@...t.ru>, Sriharsha Basavapatna
	<sriharsha.basavapatna@...adcom.com>, Somnath Kotur
	<somnath.kotur@...adcom.com>, Andrew Lunn <andrew+netdev@...n.ch>, "David S.
 Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, "Jakub
 Kicinski" <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Venkata Duvvuru
	<VenkatKumar.Duvvuru@...lex.Com>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "lvc-project@...uxtesting.org"
	<lvc-project@...uxtesting.org>
Subject: [PATCH net] be2net: check wrb_params for NULL value

From: Andrey Vatoropin <a.vatoropin@...t.ru>

be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL
at be_send_pkt_to_bmc() call site.  This may lead to dereferencing a NULL
pointer when processing a workaround for specific packet, as commit
bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6
packet") states.  Add a check for that.

Another way would be to pass a valid wrb_params from be_xmit(), but that
seems to be redundant as the corresponding bit in wrb_params should have
been already set there in advance with a call to be_xmit_workarounds().

Found by Linux Verification Center (linuxtesting.org) with SVACE.
       
Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.").
Signed-off-by: Andrey Vatoropin <a.vatoropin@...t.ru>
---
 drivers/net/ethernet/emulex/benet/be_main.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index cb004fd16252..467cc49fe1d5 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1063,7 +1063,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
 		/* f/w workaround to set skip_hw_vlan = 1, informs the F/W to
 		 * skip VLAN insertion
 		 */
-		BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1);
+		if (wrb_params)
+			BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1);
 	}
 
 	if (insert_vlan) {
@@ -1081,7 +1082,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct be_adapter *adapter,
 						vlan_tag);
 		if (unlikely(!skb))
 			return skb;
-		BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1);
+		if (wrb_params)
+			BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1);
 	}
 
 	return skb;
-- 
2.43.0