netdev - [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230615-igc-err-ptr-v1-1-a17145eb8d62@kernel.org>
Date: Thu, 15 Jun 2023 11:45:36 +0200
From: Simon Horman <horms@...nel.org>
To: Jesse Brandeburg <jesse.brandeburg@...el.com>, 
 Tony Nguyen <anthony.l.nguyen@...el.com>
Cc: Alexei Starovoitov <ast@...nel.org>, 
 Andre Guedes <andre.guedes@...el.com>, 
 Dan Carpenter <dan.carpenter@...aro.org>, 
 Daniel Borkmann <daniel@...earbox.net>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Florian Kauer <florian.kauer@...utronix.de>, 
 Jakub Kicinski <kuba@...nel.org>, Jesper Dangaard Brouer <hawk@...nel.org>, 
 Jithu Joseph <jithu.joseph@...el.com>, 
 John Fastabend <john.fastabend@...il.com>, 
 Maciej Fijalkowski <maciej.fijalkowski@...el.com>, 
 Paolo Abeni <pabeni@...hat.com>, Vedang Patel <vedang.patel@...el.com>, 
 intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org, 
 bpf@...r.kernel.org
Subject: [PATCH RFC net] igc: Avoid dereference of ptr_err in
 igc_clean_rx_irq()

In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned
to the skb local variable. This may be an ERR_PTR.

A little later the following is executed, which seems to be a
possible dereference of an ERR_PTR.

	total_bytes += skb->len;

Avoid this problem by continuing the loop in which all of the
above occurs once the handling of the NULL case completes.

This proposed fix is speculative - I do not have deep knowledge of this
driver.  And I am concerned about the effect of skipping the following
logic:

  igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
  cleaned_count++;

Flagged by Smatch as:

  .../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR'

Compile tested only.

Fixes: 26575105d6ed ("igc: Add initial XDP support")
Signed-off-by: Simon Horman <horms@...nel.org>
---
 drivers/net/ethernet/intel/igc/igc_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 88145c30c919..b58c8a674bd1 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -2586,6 +2586,7 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)

 			total_packets++;
 			total_bytes += size;
+			continue;
 		} else if (skb)
 			igc_add_rx_frag(rx_ring, rx_buffer, skb, size);
 		else if (ring_uses_build_skb(rx_ring))