From nobody Sat Feb 7 06:49:21 2026 Received: from mail.crpt.ru (mail.crpt.ru [91.236.205.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 834002FD7D0; Wed, 12 Nov 2025 09:40:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.236.205.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762940409; cv=none; b=gLQTRMHVhXRlBB4ExdypYFQePAlJWD2BCzyl9wzKJpHa9k+2OL4ciQ6u5+Q9o+uzwC65ur5FlgdzpERchScSpWNHNvYkpqFe5/GB52d+QVCvkEXqI3wPPhvOx8je9SVqQgg1FxGAFcUDTxmI2ljSU5XlVqWvIxIGtaRwLD4J67M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762940409; c=relaxed/simple; bh=wtm/toPwhxcCPbrqIOj64VZsX+Qke2L0qOuUxbs48Zs=; h=From:To:CC:Subject:Date:Message-ID:Content-Type:MIME-Version; b=aqUVU/GWF95Y5XHUohliAWikQmLGothlFfFsIXrn6XnlD2q9ZLSL1kxnGiiGwm69BrQnZ9XigKlWO0ZUa2ZYSQA8SolE38sUF5PJ8nuuFW1KwvM2NFsLBbAjkSDanlDqBUvwJ2mtdqPV6a2TYLlpYURejzCiG11cdUh3MJtEH4M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=crpt.ru; spf=pass smtp.mailfrom=crpt.ru; dkim=pass (2048-bit key) header.d=crpt.ru header.i=@crpt.ru header.b=aoYO7KS1; arc=none smtp.client-ip=91.236.205.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=crpt.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=crpt.ru Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=crpt.ru header.i=@crpt.ru header.b="aoYO7KS1" Received: from mail.crpt.ru ([192.168.60.4]) by mail.crpt.ru with ESMTPS id 5AC9L40H028943-5AC9L40J028943 (version=TLSv1.2 cipher=AES256-SHA256 bits=256 verify=OK); Wed, 12 Nov 2025 12:21:04 +0300 Received: from EX2.crpt.local (192.168.60.4) by ex2.crpt.local (192.168.60.4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.44; Wed, 12 Nov 2025 12:21:04 +0300 Received: from EX2.crpt.local ([192.168.60.4]) by EX2.crpt.local ([192.168.60.4]) with mapi id 15.01.2507.044; Wed, 12 Nov 2025 12:21:04 +0300 From: =?utf-8?B?0JLQsNGC0L7RgNC+0L/QuNC9INCQ0L3QtNGA0LXQuQ==?= To: Ajit Khaparde CC: =?utf-8?B?0JLQsNGC0L7RgNC+0L/QuNC9INCQ0L3QtNGA0LXQuQ==?= , Sriharsha Basavapatna , Somnath Kotur , Andrew Lunn , "David S. Miller" , Eric Dumazet , "Jakub Kicinski" , Paolo Abeni , Venkata Duvvuru , "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "lvc-project@linuxtesting.org" Subject: [PATCH net] be2net: check wrb_params for NULL value Thread-Topic: [PATCH net] be2net: check wrb_params for NULL value Thread-Index: AQHcU7WrbULp1sdKi0ef7fYLGowmsA== Date: Wed, 12 Nov 2025 09:21:04 +0000 Message-ID: <20251112092051.851163-1-a.vatoropin@crpt.ru> Accept-Language: ru-RU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-kse-serverinfo: EX2.crpt.local, 9 x-kse-antivirus-interceptor-info: scan successful x-kse-antivirus-info: Clean, bases: 11/11/2025 10:59:00 PM x-kse-attachment-filter-triggered-rules: Clean x-kse-attachment-filter-triggered-filters: Clean x-kse-bulkmessagesfiltering-scan-result: protection disabled Content-Type: text/plain; charset="utf-8" Content-ID: <0BDF0E96873DB94EBE800CD783423EB4@crpt.ru> Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-FEAS-BEC-Info: WlpIGw0aAQkEARIJHAEHBlJSCRoLAAEeDUhZUEhYSFhIWUhZXkguLVxYWC48UVlRWFhYWVxaSFlRSAlGHgkcBxoHGAEGKAsaGBxGGh1IWUhaXkgJAgEcRgMACRgJGgwNKAoaBwkMCwcFRgsHBUhYSFpIWVpIWVFaRlleUEZeWEZcSFBIWEhYSFFIWEhYSFhIWl5ICQIBHEYDAAkYCRoMDSgKGgcJDAsHBUYLBwVIWEhaWUgJBgwaDR9DBg0cDA0eKAQdBgZGCwBIWEhZUUgMCR4NBSgMCR4NBQQHDhxGBg0cSFhIWVFIDQwdBQkSDRwoDwcHDwQNRgsHBUhYSFldSAMdCgkoAw0aBg0ERgcaD0hYSFpQSAQBBh0QRQMNGgYNBCgeDw0aRgMNGgYNBEYHGg9IWEhaUEgEHgtFGBoHAg0LHCgEAQYdEBwNGxwBBg9GBxoPSFhIWV9IGAkKDQYBKBoNDAAJHEYLBwVIWEhbWEg+DQYDCRwjHQUJGkYsHR4eHRodKA0FHQQNEEYLBwVIWA== X-FEAS-Client-IP: 192.168.60.4 X-FE-Policy-ID: 2:4:0:SYSTEM DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=crpt.ru; s=crpt.ru; c=relaxed/relaxed; h=from:to:cc:subject:date:message-id:content-type:mime-version; bh=wtm/toPwhxcCPbrqIOj64VZsX+Qke2L0qOuUxbs48Zs=; b=aoYO7KS1yOvF0gl86TPvox2fEDlU2oggnadThVRcHezOb+F5IeozPMtyw6Pu3YnZ7eiIhz0+clkJ ghUz106MUfDOIYH/L+BGtqNfK2L3UMWps0ASjsBf/2m1gSBSOurpMwrEqiedD7SKikC1A1qnGdUB LUfXurCGYqm6BJCENUEyNelnEyV3N4qhvNQFWAgb9PanwSE5DpdVBrgES1ekvxxgwhDNdWSEGIj6 eTitBGj09tMc/8N7az/PiCIRvNbYmb1UpIJcdLJ8IKHYooFuYmk4kJZNrMrnL4CTXTNHPsh6Fvv+ XWwhDj0RFW5+NK1/Lc5zBx7FqOjU/Sy1ZwBmaw== From: Andrey Vatoropin be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.=C2=A0 This may lead to dereferencing a N= ULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states.=C2=A0 Add a check for that. Another way would be to pass a valid wrb_params from be_xmit(), but that seems to be redundant as the corresponding bit in wrb_params should have been already set there in advance with a call to be_xmit_workarounds(). Found by Linux Verification Center (linuxtesting.org) with SVACE. =20 Fixes: 760c295e0e8d ("be2net: Support for OS2BMC."). Signed-off-by: Andrey Vatoropin --- drivers/net/ethernet/emulex/benet/be_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethe= rnet/emulex/benet/be_main.c index cb004fd16252..467cc49fe1d5 100644 --- a/drivers/net/ethernet/emulex/benet/be_main.c +++ b/drivers/net/ethernet/emulex/benet/be_main.c @@ -1063,7 +1063,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct b= e_adapter *adapter, /* f/w workaround to set skip_hw_vlan =3D 1, informs the F/W to * skip VLAN insertion */ - BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); + if (wrb_params) + BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); } =20 if (insert_vlan) { @@ -1081,7 +1082,8 @@ static struct sk_buff *be_insert_vlan_in_pkt(struct b= e_adapter *adapter, vlan_tag); if (unlikely(!skb)) return skb; - BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); + if (wrb_params) + BE_WRB_F_SET(wrb_params->features, VLAN_SKIP_HW, 1); } =20 return skb; --=20 2.43.0