lkml.org 
[lkml]   [2018]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v2 1/1] net: check before dereferencing netdev_ops during busy poll
From
Date


On 03/12/2018 10:32 PM, Josh Elsasser wrote:
> init_dummy_netdev() leaves its netdev_ops pointer zeroed. This leads
> to a NULL pointer dereference when sk_busy_loop fires against an iwlwifi
> wireless adapter and checks napi->dev->netdev_ops->ndo_busy_poll.
>
> Avoid this by ensuring napi->dev->netdev_ops is valid before following
> the pointer, avoiding the following panic when busy polling on a dummy
> netdev:
>


>
> Fixes: 060212928670 ("net: add low latency socket poll")
> Fixes: ce6aea93f751 ("net: network drivers no longer need to implement ndo_busy_poll()") - 4.9.y
> Signed-off-by: Josh Elsasser <jelsasser@appneta.com>
> ---
> net/core/dev.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 8898618bf341..1f50c131ed15 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5042,7 +5042,10 @@ bool sk_busy_loop(struct sock *sk, int nonblock)
> goto out;
>
> /* Note: ndo_busy_poll method is optional in linux-4.5 */
> - busy_poll = napi->dev->netdev_ops->ndo_busy_poll;
> + if (napi->dev->netdev_ops)
> + busy_poll = napi->dev->netdev_ops->ndo_busy_poll;
> + else
> + busy_poll = NULL;
>
> do {
> rc = 0;
>
We could instead setup a non NULL netdev_ops pointer on these 'dummy'
devices to not add a check in fast path, but I presume we do
not really care since this fix is for old kernels, and considering how
long it took to discover this bug.

Reviewed-by: Eric Dumazet <edumazet@google.com>

\
 
 \ /
  Last update: 2018-03-13 06:51    [W:0.042 / U:0.172 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site