From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 390CBC3DA63 for ; Wed, 24 Jul 2024 17:41:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:In-Reply-To:Content-Type: MIME-Version:References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=rcnE9O1HP/on4DXZ2YGJRZa8Na/4XLmBvUuuq71+hJw=; b=sl+rVOksi1bgtCgW50g/+G7C5m 4+FD16aA7aKVbxIeNvsgGKmMBf/Cjubi7rATU6oPwxvB5TP5jz2qc1LxAWXWiHS4AQ0bQizlX3YBN khC38c5Xxm43e9UmppmstDP3gJHvb3rEPsJ9srEz4sIC2ta761k6W9WoUSAygcS6ndX9DRNFKK5nW cW56TylH79xxtHiyY01/lXbY+f1FdRWPI8tOiBy1tHpEOQAb8xlv5NMoCdxs3mPQKEXFVfkNeoF9a iWcaQI5vGUVcLN/Gz5cugs5mNm7Ot9PsPapPPg93dV+GAcr1Ep2fC6dIlCwYb1p1lA2EOPcY5i2vd 7r1XmZig==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1sWfz4-0000000G7Kq-1uaB; Wed, 24 Jul 2024 17:41:02 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1sWfyf-0000000G7FZ-3cAa; Wed, 24 Jul 2024 17:40:39 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by dfw.source.kernel.org (Postfix) with ESMTP id E0B0461251; Wed, 24 Jul 2024 17:40:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75F26C32781; Wed, 24 Jul 2024 17:40:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1721842836; bh=SOl/CnsBeml/c/uFV3EVy7ROsbF7eOEe3MGPrAA8AiM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=RqUbpi6gNeWL/Lz7GUghvjd66vRZhZGhounFOZLOYDRsEHCjBpc7JiRrSrwPHUt9+ Gh5+Vkg9CXtRqozH5m5U3tz3aHpNjP6ZhsvJo0voIXqWO/R2BAXbqIkwVfcpeqCMPL cFhgX33eZNkVi9IdTNekrGVc4XOb6/FoN8H8TRHvz/btOi6KjKe3/5dA1s0+lsemIJ tnNVHb3ldFlDcfdLRIUhwHt2D8dur/ytsbk/TeDahOeXAL2DCT2EY28UiwUgGylg2B LBxAtgEHGuLkyPa5u7awYaoYHf2iqJmE8yQh/7/eZTg6LrSzP7NvzISxlxSEuXh0wy geWMa1w8W4FTw== Date: Wed, 24 Jul 2024 18:40:31 +0100 From: Simon Horman To: Breno Leitao Cc: Felix Fietkau , Sean Wang , Mark Lee , Lorenzo Bianconi , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Matthias Brugger , AngeloGioacchino Del Regno , leit@meta.com, Dan Carpenter , "open list:MEDIATEK ETHERNET DRIVER" , "open list:ARM/Mediatek SoC support" , "moderated list:ARM/Mediatek SoC support" , "moderated list:ARM/Mediatek SoC support" Subject: Re: [PATCH net] net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling Message-ID: <20240724174031.GF97837@kernel.org> References: <20240724080524.2734499-1-leitao@debian.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240724080524.2734499-1-leitao@debian.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240724_104037_961770_5B6C6CE0 X-CRM114-Status: GOOD ( 10.95 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Jul 24, 2024 at 01:05:23AM -0700, Breno Leitao wrote: > Move the freeing of the dummy net_device from mtk_free_dev() to > mtk_remove(). > > Previously, if alloc_netdev_dummy() failed in mtk_probe(), > eth->dummy_dev would be NULL. The error path would then call > mtk_free_dev(), which in turn called free_netdev() assuming dummy_dev > was allocated (but it was not), potentially causing a NULL pointer > dereference. > > By moving free_netdev() to mtk_remove(), we ensure it's only called when > mtk_probe() has succeeded and dummy_dev is fully allocated. This > addresses a potential NULL pointer dereference detected by Smatch[1]. > > Fixes: b209bd6d0bff ("net: mediatek: mtk_eth_sock: allocate dummy net_device dynamically") > Reported-by: Dan Carpenter > Closes: https://lore.kernel.org/all/4160f4e0-cbef-4a22-8b5d-42c4d399e1f7@stanley.mountain/ [1] > Suggested-by: Dan Carpenter > Reviewed-by: Dan Carpenter > Signed-off-by: Breno Leitao Reviewed-by: Simon Horman ...