[PATCH RESEND net-next] net: ethtool: Fix the panic caused by dev being null when dumping coalesce

[PATCH RESEND net-next] net: ethtool: Fix the panic caused by dev being null when dumping coalesce

[Heng Qi]

syzbot reported a general protection fault caused by a null pointer
dereference in coalesce_fill_reply(). The issue occurs when req_base->dev
is null, leading to an invalid memory access.

This panic occurs if dumping coalesce when no device name is specified.

Fixes: f750dfe825b9 ("ethtool: provide customized dim profile management")
Reported-by: syzbot+e77327e34cdc8c36b7d3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e77327e34cdc8c36b7d3
Signed-off-by: Heng Qi <hengqi@linux.alibaba.com>
---
This fix patch is re-sent to next branch instead of net branch
because the target commit is in the next branch.

 net/ethtool/coalesce.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ethtool/coalesce.c b/net/ethtool/coalesce.c
index 759b16e3d134..3e18ca1ccc5e 100644
--- a/net/ethtool/coalesce.c
+++ b/net/ethtool/coalesce.c
@@ -211,9 +211,9 @@ static int coalesce_fill_reply(struct sk_buff *skb,
 {
 	const struct coalesce_reply_data *data = COALESCE_REPDATA(reply_base);
 	const struct kernel_ethtool_coalesce *kcoal = &data->kernel_coalesce;
-	struct dim_irq_moder *moder = req_base->dev->irq_moder;
 	const struct ethtool_coalesce *coal = &data->coalesce;
 	u32 supported = data->supported_params;
+	struct dim_irq_moder *moder;
 	int ret = 0;
 
 	if (coalesce_put_u32(skb, ETHTOOL_A_COALESCE_RX_USECS,
@@ -272,9 +272,10 @@ static int coalesce_fill_reply(struct sk_buff *skb,
 			     kcoal->tx_aggr_time_usecs, supported))
 		return -EMSGSIZE;
 
-	if (!moder)
+	if (!req_base->dev || !req_base->dev->irq_moder)
 		return 0;
 
+	moder = req_base->dev->irq_moder;
 	rcu_read_lock();
 	if (moder->profile_flags & DIM_PROFILE_RX) {
 		ret = coalesce_put_profile(skb, ETHTOOL_A_COALESCE_RX_PROFILE,
-- 
2.32.0.3.g01195cf9f

Re: [PATCH RESEND net-next] net: ethtool: Fix the panic caused by dev being null when dumping coalesce

[Simon Horman]

On Fri, Jun 28, 2024 at 12:40:18PM +0800, Heng Qi wrote:
> syzbot reported a general protection fault caused by a null pointer
> dereference in coalesce_fill_reply(). The issue occurs when req_base->dev
> is null, leading to an invalid memory access.
> 
> This panic occurs if dumping coalesce when no device name is specified.
> 
> Fixes: f750dfe825b9 ("ethtool: provide customized dim profile management")
> Reported-by: syzbot+e77327e34cdc8c36b7d3@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e77327e34cdc8c36b7d3
> Signed-off-by: Heng Qi <hengqi@linux.alibaba.com>
> ---
> This fix patch is re-sent to next branch instead of net branch
> because the target commit is in the next branch.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH RESEND net-next] net: ethtool: Fix the panic caused by dev being null when dumping coalesce

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by David S. Miller <davem@davemloft.net>:

On Fri, 28 Jun 2024 12:40:18 +0800 you wrote:
> syzbot reported a general protection fault caused by a null pointer
> dereference in coalesce_fill_reply(). The issue occurs when req_base->dev
> is null, leading to an invalid memory access.
> 
> This panic occurs if dumping coalesce when no device name is specified.
> 
> Fixes: f750dfe825b9 ("ethtool: provide customized dim profile management")
> Reported-by: syzbot+e77327e34cdc8c36b7d3@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e77327e34cdc8c36b7d3
> Signed-off-by: Heng Qi <hengqi@linux.alibaba.com>
> 
> [...]

Here is the summary with links:
  - [RESEND,net-next] net: ethtool: Fix the panic caused by dev being null when dumping coalesce
    https://git.kernel.org/netdev/net-next/c/74d6529b78f7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html