Re: [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx_irq()

From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
To: Simon Horman <horms@kernel.org>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>,
	Tony Nguyen <anthony.l.nguyen@intel.com>,
	Alexei Starovoitov <ast@kernel.org>,
	"Andre Guedes" <andre.guedes@intel.com>,
	Dan Carpenter <dan.carpenter@linaro.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Florian Kauer <florian.kauer@linutronix.de>,
	Jakub Kicinski <kuba@kernel.org>,
	"Jesper Dangaard Brouer" <hawk@kernel.org>,
	Jithu Joseph <jithu.joseph@intel.com>,
	John Fastabend <john.fastabend@gmail.com>,
	Paolo Abeni <pabeni@redhat.com>,
	Vedang Patel <vedang.patel@intel.com>,
	<intel-wired-lan@lists.osuosl.org>, <netdev@vger.kernel.org>,
	<bpf@vger.kernel.org>
Subject: Re: [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx_irq()
Date: Thu, 15 Jun 2023 11:55:29 +0200	[thread overview]
Message-ID: <ZIrgEVVQfvJwneLx@boxer> (raw)
In-Reply-To: <20230615-igc-err-ptr-v1-1-a17145eb8d62@kernel.org>

On Thu, Jun 15, 2023 at 11:45:36AM +0200, Simon Horman wrote:

Hi Simon,

> In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned
> to the skb local variable. This may be an ERR_PTR.
> 
> A little later the following is executed, which seems to be a
> possible dereference of an ERR_PTR.
> 
> 	total_bytes += skb->len;
> 
> Avoid this problem by continuing the loop in which all of the
> above occurs once the handling of the NULL case completes.
> 
> This proposed fix is speculative - I do not have deep knowledge of this
> driver.  And I am concerned about the effect of skipping the following
> logic:
> 
>   igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
>   cleaned_count++;

this will break - you have to recycle the buffer to have it going.

> 
> Flagged by Smatch as:
> 
>   .../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR'

how about PTR_ERR_OR_ZERO() ? this would silence smatch and is not an
intrusive change. another way is to get rid of ERR_PTR() around skb/xdp
run result but i think the former would be just fine.

> 
> Compile tested only.
> 
> Fixes: 26575105d6ed ("igc: Add initial XDP support")
> Signed-off-by: Simon Horman <horms@kernel.org>
> ---
>  drivers/net/ethernet/intel/igc/igc_main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
> index 88145c30c919..b58c8a674bd1 100644
> --- a/drivers/net/ethernet/intel/igc/igc_main.c
> +++ b/drivers/net/ethernet/intel/igc/igc_main.c
> @@ -2586,6 +2586,7 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
>  
>  			total_packets++;
>  			total_bytes += size;
> +			continue;
>  		} else if (skb)
>  			igc_add_rx_frag(rx_ring, rx_buffer, skb, size);
>  		else if (ring_uses_build_skb(rx_ring))
> 
> 