netdev - Re: [PATCH v5 net] ps3/gelic: Fix SKB allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ede0bba8-4385-40bd-99a3-5020b22e52eb@csgroup.eu>
Date: Mon, 19 Feb 2024 10:17:25 +0000
From: Christophe Leroy <christophe.leroy@...roup.eu>
To: Geoff Levand <geoff@...radead.org>
CC: sambat goson <sombat3960@...il.com>, Paolo Abeni <pabeni@...hat.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, "David S. Miller"
	<davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>
Subject: Re: [PATCH v5 net] ps3/gelic: Fix SKB allocation



Le 19/02/2024 à 10:12, Geoff Levand a écrit :
> Commit 3ce4f9c3fbb3 ("net/ps3_gelic_net: Add gelic_descr structures") of
> 6.8-rc1 had a copy-and-paste error where the pointer that holds the
> allocated SKB (struct gelic_descr.skb)  was set to NULL after the SKB was
> allocated. This resulted in a kernel panic when the SKB pointer was
> accessed.
> 
> This fix moves the initialization of the gelic_descr to before the SKB
> is allocated.
> 
> Reported-by: sambat goson <sombat3960@...il.com>
> Fixes: 3ce4f9c3fbb3 ("net/ps3_gelic_net: Add gelic_descr structures")
> Signed-off-by: Geoff Levand <geoff@...radead.org>
> 
> diff --git a/drivers/net/ethernet/toshiba/ps3_gelic_net.c b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
> index d5b75af163d3..28116891d2ce 100644
> --- a/drivers/net/ethernet/toshiba/ps3_gelic_net.c
> +++ b/drivers/net/ethernet/toshiba/ps3_gelic_net.c
> @@ -384,11 +384,6 @@ static int gelic_descr_prepare_rx(struct gelic_card *card,
>   	if (gelic_descr_get_status(descr) !=  GELIC_DESCR_DMA_NOT_IN_USE)
>   		dev_info(ctodev(card), "%s: ERROR status\n", __func__);
>   
> -	descr->skb = netdev_alloc_skb(*card->netdev, rx_skb_size);
> -	if (!descr->skb) {
> -		descr->hw_regs.payload.dev_addr = 0; /* tell DMAC don't touch memory */
> -		return -ENOMEM;
> -	}
>   	descr->hw_regs.dmac_cmd_status = 0;
>   	descr->hw_regs.result_size = 0;
>   	descr->hw_regs.valid_size = 0;
> @@ -397,6 +392,12 @@ static int gelic_descr_prepare_rx(struct gelic_card *card,
>   	descr->hw_regs.payload.size = 0;
>   	descr->skb = NULL;

You are unconditionaly re-assigning value to descr->skb below, so above 
line is useless and should be removed.

>   
> +	descr->skb = netdev_alloc_skb(*card->netdev, rx_skb_size);
> +	if (!descr->skb) {
> +		descr->hw_regs.payload.dev_addr = 0; /* tell DMAC don't touch memory */
> +		return -ENOMEM;
> +	}
> +

Is this code move needed at all ?

At the end, isn't it enough to just drop the line descr->skb = NULL; ?

Christophe

>   	offset = ((unsigned long)descr->skb->data) &
>   		(GELIC_NET_RXBUF_ALIGN - 1);
>   	if (offset)