netdev - [PATCH bpf-next] nfp: fix variable dereferenced before check in nfp_app_ctrl_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180731033315.2430-1-jakub.kicinski@netronome.com>
Date:   Mon, 30 Jul 2018 20:33:15 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     alexei.starovoitov@...il.com, daniel@...earbox.net
Cc:     netdev@...r.kernel.org, oss-drivers@...ronome.com,
        Jakub Kicinski <jakub.kicinski@...ronome.com>
Subject: [PATCH bpf-next] nfp: fix variable dereferenced before check in nfp_app_ctrl_rx_raw()

'app' is dereferenced before used for the devlink trace point.
In case FW is buggy and sends a control message to a VF queue
we should make sure app is not NULL.

Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@...ronome.com>
Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@...ronome.com>
---
 drivers/net/ethernet/netronome/nfp/nfp_app.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app.h b/drivers/net/ethernet/netronome/nfp/nfp_app.h
index ccb244cf6c30..4e1eb3395648 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_app.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_app.h
@@ -392,10 +392,11 @@ static inline void nfp_app_ctrl_rx(struct nfp_app *app, struct sk_buff *skb)
 static inline void
 nfp_app_ctrl_rx_raw(struct nfp_app *app, const void *data, unsigned int len)
 {
-	trace_devlink_hwmsg(priv_to_devlink(app->pf), true, 0, data, len);
+	if (!app || !app->type->ctrl_msg_rx_raw)
+		return;
 
-	if (app && app->type->ctrl_msg_rx_raw)
-		app->type->ctrl_msg_rx_raw(app, data, len);
+	trace_devlink_hwmsg(priv_to_devlink(app->pf), true, 0, data, len);
+	app->type->ctrl_msg_rx_raw(app, data, len);
 }
 
 static inline int nfp_app_eswitch_mode_get(struct nfp_app *app, u16 *mode)
-- 
2.17.1