[v1] liquidio: Fix potential null pointer dereference

[PATCH] liquidio: Fix potential null pointer dereference

Posted by Aleksandr Mishin 1 year, 9 months ago

In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
but then it is unconditionally passed to skb_add_rx_frag() which could
lead to null pointer dereference.
Fix this bug by moving skb_add_rx_frag() into conditional scope.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1f233f327913 (liquidio: switchdev support for LiquidIO NIC)
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
---
 drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
index aa6c0dfb6f1c..e26b4ed33dc8 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c
@@ -272,13 +272,12 @@ lio_vf_rep_copy_packet(struct octeon_device *oct,
 				pg_info->page_offset;
 			memcpy(skb->data, va, MIN_SKB_SIZE);
 			skb_put(skb, MIN_SKB_SIZE);
+			skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+					pg_info->page,
+					pg_info->page_offset + MIN_SKB_SIZE,
+					len - MIN_SKB_SIZE,
+					LIO_RXBUFFER_SZ);
 		}
-
-		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
-				pg_info->page,
-				pg_info->page_offset + MIN_SKB_SIZE,
-				len - MIN_SKB_SIZE,
-				LIO_RXBUFFER_SZ);
 	} else {
 		struct octeon_skb_page_info *pg_info =
 			((struct octeon_skb_page_info *)(skb->cb));
-- 
2.30.2

Re: [PATCH] liquidio: Fix potential null pointer dereference

Posted by Simon Horman 1 year, 9 months ago

On Thu, Mar 07, 2024 at 12:29:32PM +0300, Aleksandr Mishin wrote:
> In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
> but then it is unconditionally passed to skb_add_rx_frag() which could
> lead to null pointer dereference.
> Fix this bug by moving skb_add_rx_frag() into conditional scope.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: 1f233f327913 (liquidio: switchdev support for LiquidIO NIC)

A correct format for the tag above is:

Fixes: 1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")

> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>

I guess this code is never hit.
But I agree this should be fixed.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH] liquidio: Fix potential null pointer dereference

Posted by Kees Cook 1 year, 9 months ago

On Fri, Mar 08, 2024 at 08:19:11PM +0000, Simon Horman wrote:
> On Thu, Mar 07, 2024 at 12:29:32PM +0300, Aleksandr Mishin wrote:
> > In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,
> > but then it is unconditionally passed to skb_add_rx_frag() which could
> > lead to null pointer dereference.
> > Fix this bug by moving skb_add_rx_frag() into conditional scope.
> > 
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > 
> > Fixes: 1f233f327913 (liquidio: switchdev support for LiquidIO NIC)
> 
> A correct format for the tag above is:
> 
> Fixes: 1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")

FWIW, I have this in my ~/.gitconfig[1]:

[alias]
        short = "!f() { for i in \"$@\"; do git log -1 --pretty='%h (\"%s\")' \"$i\"; done; }; f"


then I can type:

$ short 1f233f327913f3dee0602cba9c64df1903772b55
1f233f327913 ("liquidio: switchdev support for LiquidIO NIC")


-Kees

[1] https://github.com/kees/kernel-tools/blob/trunk/ENVIRONMENT.md#git-command-aliases-gitconfig

-- 
Kees Cook