lkml.org 
[lkml]   [2019]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.1 221/371] iavf: fix dereference of null rx_buffer pointer
    Date
    [ Upstream commit 9fe06a51287b2d41baef7ece94df34b5abf19b90 ]

    A recent commit efa14c3985828d ("iavf: allow null RX descriptors") added
    a null pointer sanity check on rx_buffer, however, rx_buffer is being
    dereferenced before that check, which implies a null pointer dereference
    bug can potentially occur. Fix this by only dereferencing rx_buffer
    until after the null pointer check.

    Addresses-Coverity: ("Dereference before null check")
    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/intel/iavf/iavf_txrx.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c
    index 9cc2a617c9f3..2a261d849d5a 100644
    --- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c
    +++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c
    @@ -1296,7 +1296,7 @@ static struct sk_buff *iavf_construct_skb(struct iavf_ring *rx_ring,
    struct iavf_rx_buffer *rx_buffer,
    unsigned int size)
    {
    - void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
    + void *va;
    #if (PAGE_SIZE < 8192)
    unsigned int truesize = iavf_rx_pg_size(rx_ring) / 2;
    #else
    @@ -1308,6 +1308,7 @@ static struct sk_buff *iavf_construct_skb(struct iavf_ring *rx_ring,
    if (!rx_buffer)
    return NULL;
    /* prefetch first cache line of first page */
    + va = page_address(rx_buffer->page) + rx_buffer->page_offset;
    prefetch(va);
    #if L1_CACHE_BYTES < 128
    prefetch(va + L1_CACHE_BYTES);
    @@ -1362,7 +1363,7 @@ static struct sk_buff *iavf_build_skb(struct iavf_ring *rx_ring,
    struct iavf_rx_buffer *rx_buffer,
    unsigned int size)
    {
    - void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;
    + void *va;
    #if (PAGE_SIZE < 8192)
    unsigned int truesize = iavf_rx_pg_size(rx_ring) / 2;
    #else
    @@ -1374,6 +1375,7 @@ static struct sk_buff *iavf_build_skb(struct iavf_ring *rx_ring,
    if (!rx_buffer)
    return NULL;
    /* prefetch first cache line of first page */
    + va = page_address(rx_buffer->page) + rx_buffer->page_offset;
    prefetch(va);
    #if L1_CACHE_BYTES < 128
    prefetch(va + L1_CACHE_BYTES);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-07-24 22:09    [W:2.401 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site