Re: [PATCH net-next v2 2/2] devlink: sb: do not dereference a missing shared buffer

[Ivan Vecera <ivecera@redhat.com>]

On 11/2/26 14:15, Linkui Xiao wrote:
> From: Linkui Xiao <xiaolinkui@kylinos.cn>
> 
> devl_sb_unregister() looks the shared buffer up by index and only warns
> when it is not on the list. list_del() and kfree() are then called on the
> NULL result, so unregistering an index that was never registered, or
> unregistering the same index twice, turns the warning into a NULL pointer
> dereference. list is the first member of struct devlink_sb, so list_del()
> reads the next and prev pointers from address 0 before storing to them.
> 
> The register side already fails gracefully: devl_sb_register() returns
> -EEXIST when the index is taken. Make the unregister side symmetric and
> return after the warning.
> 
> Fixes: bf7974710a40 ("devlink: add shared buffer configuration")
> Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>
> Reviewed-by: Simon Horman <horms@kernel.org>
> Link: https://lore.kernel.org/r/20261030033332.3685172-3-xiaolinkui@126.com
> ---
> v2: reposted against net-next at Simon's suggestion; no code change.
Reviewed-by: Ivan Vecera <ivecera@redhat.com>