netdev - [PATCH] i40e: Fix potential invalid access when MAC list is empty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250827032348.1374048-1-zhen.ni@easystack.cn>
Date: Wed, 27 Aug 2025 11:23:48 +0800
From: Zhen Ni <zhen.ni@...ystack.cn>
To: anthony.l.nguyen@...el.com,
	przemyslaw.kitszel@...el.com,
	andrew+netdev@...n.ch,
	davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com
Cc: intel-wired-lan@...ts.osuosl.org,
	netdev@...r.kernel.org,
	Zhen Ni <zhen.ni@...ystack.cn>
Subject: [PATCH] i40e: Fix potential invalid access when MAC list is empty

list_first_entry() never returns NULL — if the list is empty, it still
returns a pointer to an invalid object, leading to potential invalid
memory access when dereferenced.

Fix this by checking list_empty() before calling list_first_entry(),
and only copying the MAC address when the list is not empty.

Fixes: e3219ce6a775 ("i40e: Add support for client interface for IWARP driver")
Signed-off-by: Zhen Ni <zhen.ni@...ystack.cn>
---
 drivers/net/ethernet/intel/i40e/i40e_client.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index 5f1a405cbbf8..0a72157aee0e 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -359,12 +359,13 @@ static void i40e_client_add_instance(struct i40e_pf *pf)
 	if (i40e_client_get_params(vsi, &cdev->lan_info.params))
 		goto free_cdev;
 
-	mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
-			       struct netdev_hw_addr, list);
-	if (mac)
+	if (!list_empty(&cdev->lan_info.netdev->dev_addrs.list)) {
+		mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
+				       struct netdev_hw_addr, list);
 		ether_addr_copy(cdev->lan_info.lanmac, mac->addr);
-	else
+	} else {
 		dev_err(&pf->pdev->dev, "MAC address list is empty!\n");
+	}
 
 	pf->cinst = cdev;
 
-- 
2.20.1