[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240628044018.73885-1-hengqi@linux.alibaba.com>
Date: Fri, 28 Jun 2024 12:40:18 +0800
From: Heng Qi <hengqi@...ux.alibaba.com>
To: netdev@...r.kernel.org
Cc: Jakub Kicinski <kuba@...nel.org>,
Eric Dumazet <edumazet@...gle.com>,
"David S. Miller" <davem@...emloft.net>,
Paolo Abeni <pabeni@...hat.com>,
Vladimir Oltean <vladimir.oltean@....com>,
Jiri Pirko <jiri@...nulli.us>,
Simon Horman <horms@...nel.org>,
syzbot+e77327e34cdc8c36b7d3@...kaller.appspotmail.com
Subject: [PATCH RESEND net-next] net: ethtool: Fix the panic caused by dev being null when dumping coalesce
syzbot reported a general protection fault caused by a null pointer
dereference in coalesce_fill_reply(). The issue occurs when req_base->dev
is null, leading to an invalid memory access.
This panic occurs if dumping coalesce when no device name is specified.
Fixes: f750dfe825b9 ("ethtool: provide customized dim profile management")
Reported-by: syzbot+e77327e34cdc8c36b7d3@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e77327e34cdc8c36b7d3
Signed-off-by: Heng Qi <hengqi@...ux.alibaba.com>
---
This fix patch is re-sent to next branch instead of net branch
because the target commit is in the next branch.
net/ethtool/coalesce.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/ethtool/coalesce.c b/net/ethtool/coalesce.c
index 759b16e3d134..3e18ca1ccc5e 100644
--- a/net/ethtool/coalesce.c
+++ b/net/ethtool/coalesce.c
@@ -211,9 +211,9 @@ static int coalesce_fill_reply(struct sk_buff *skb,
{
const struct coalesce_reply_data *data = COALESCE_REPDATA(reply_base);
const struct kernel_ethtool_coalesce *kcoal = &data->kernel_coalesce;
- struct dim_irq_moder *moder = req_base->dev->irq_moder;
const struct ethtool_coalesce *coal = &data->coalesce;
u32 supported = data->supported_params;
+ struct dim_irq_moder *moder;
int ret = 0;
if (coalesce_put_u32(skb, ETHTOOL_A_COALESCE_RX_USECS,
@@ -272,9 +272,10 @@ static int coalesce_fill_reply(struct sk_buff *skb,
kcoal->tx_aggr_time_usecs, supported))
return -EMSGSIZE;
- if (!moder)
+ if (!req_base->dev || !req_base->dev->irq_moder)
return 0;
+ moder = req_base->dev->irq_moder;
rcu_read_lock();
if (moder->profile_flags & DIM_PROFILE_RX) {
ret = coalesce_put_profile(skb, ETHTOOL_A_COALESCE_RX_PROFILE,
--
2.32.0.3.g01195cf9f
Powered by blists - more mailing lists