All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jakub Kicinski <kuba@kernel.org>
To: Mina Almasry <almasrymina@google.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Paolo Abeni <pabeni@redhat.com>, Simon Horman <horms@kernel.org>,
	Stanislav Fomichev <sdf@fomichev.me>
Subject: Re: [PATCH net-next v1] net: devmem: NULL check netdev_nl_get_dma_dev return value
Date: Fri, 29 Aug 2025 17:52:22 -0700	[thread overview]
Message-ID: <20250829175222.32d500ca@kernel.org> (raw)
In-Reply-To: <20250829220003.3310242-1-almasrymina@google.com>

On Fri, 29 Aug 2025 21:59:38 +0000 Mina Almasry wrote:
> netdev_nl_get_dma_dev can return NULL. This happens in the unlikely
> scenario that netdev->dev.parent is NULL, or all the calls to the
> ndo_queue_get_dma_dev return NULL from the driver.

I probably have Friday brain but I don't see what you mean..
In net-next net_devmem_bind_dmabuf() gets a dma_dev and returns
-EOPNOTSUPP PTR if its NULL.

> Current code doesn't NULL check the return value, so it may be passed to
> net_devmem_bind_dmabuf, which AFAICT will eventually hit
> WARN_ON(!dmabuf || !dev) in dma_buf_dynamic_attach and do a kernel
> splat. Avoid this scenario by using IS_ERR_OR_NULL in place of IS_ERR.
> 
> Found by code inspection.
> 
> Note that this was a problem even before the fixes patch, since we
> passed netdev->dev.parent to net_devmem_bind_dmabuf before NULL checking
> it anyway :( But that code got removed in the fixes patch (and retained
> the bug).

If the bug exists in net please send a fix for net, and ignore net-next.
Maintainers will cope with the merge.

  parent reply	other threads:[~2025-08-30  0:52 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-08-29 21:59 [PATCH net-next v1] net: devmem: NULL check netdev_nl_get_dma_dev return value Mina Almasry
2025-08-29 22:02 ` Mina Almasry
2025-08-30  0:52 ` Jakub Kicinski [this message]
2025-09-02 15:54   ` Stanislav Fomichev
2025-09-02 16:14     ` Mina Almasry
  -- strict thread matches above, loose matches on Subject: below --
2025-08-30 19:09 kernel test robot
2025-09-01 11:35 ` Dan Carpenter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250829175222.32d500ca@kernel.org \
    --to=kuba@kernel.org \
    --cc=almasrymina@google.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=sdf@fomichev.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.