netdev - [PATCH net] nfp: do not send control messages during cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201211092738.3358-1-simon.horman@netronome.com>
Date:   Fri, 11 Dec 2020 10:27:38 +0100
From:   Simon Horman <simon.horman@...ronome.com>
To:     David Miller <davem@...emloft.net>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        Louis Peens <louis.peens@...ronome.com>,
        netdev@...r.kernel.org, oss-drivers@...ronome.com,
        Simon Horman <simon.horman@...ronome.com>,
        wenxu <wenxu@...oud.cn>
Subject: [PATCH net] nfp: do not send control messages during cleanup

On cleanup the txbufs are freed before app cleanup. But app clean-up may
result in control messages due to use of common control paths. There is no
need to clean-up the NIC in such cases so simply discard requests. Without
such a check a NULL pointer dereference occurs.

Fixes: a1db217861f3 ("net: flow_offload: fix flow_indr_dev_unregister path")
Cc: wenxu <wenxu@...oud.cn>
Signed-off-by: Simon Horman <simon.horman@...ronome.com>
Signed-off-by: Louis Peens <louis.peens@...ronome.com>
---
 drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index b4acf2f41e84..d86f68aa89bf 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -2084,6 +2084,15 @@ nfp_ctrl_tx_one(struct nfp_net *nn, struct nfp_net_r_vector *r_vec,
 	dp = &r_vec->nfp_net->dp;
 	tx_ring = r_vec->tx_ring;
 
+	if (!tx_ring->txbufs)
+		/* On cleanup the txbufs are freed before app cleanup.
+		 * But app clean-up may result in control messages due to
+		 * use of common control paths. There is no need to
+		 * clean-up the NIC in such cases so simply discard
+		 * requests.
+		 */
+		goto err_free;
+
 	if (WARN_ON_ONCE(skb_shinfo(skb)->nr_frags)) {
 		nn_dp_warn(dp, "Driver's CTRL TX does not implement gather\n");
 		goto err_free;
-- 
2.20.1