[PATCH net] mctp i2c: handle NULL header address

[PATCH net] mctp i2c: handle NULL header address

[Matt Johnston via B4 Relay]

From: Matt Johnston <matt@codeconstruct.com.au>

daddr can be NULL if there is no neighbour table entry present,
in that case the tx packet should be dropped.

Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver")
Cc: stable@vger.kernel.org
Reported-by: Dung Cao <dung@os.amperecomputing.com>
Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
---
 drivers/net/mctp/mctp-i2c.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git drivers/net/mctp/mctp-i2c.c drivers/net/mctp/mctp-i2c.c
index 4dc057c121f5..e70fb6687994 100644
--- drivers/net/mctp/mctp-i2c.c
+++ drivers/net/mctp/mctp-i2c.c
@@ -588,6 +588,9 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev,
 	if (len > MCTP_I2C_MAXMTU)
 		return -EMSGSIZE;
 
+	if (!daddr || !saddr)
+		return -EINVAL;
+
 	lldst = *((u8 *)daddr);
 	llsrc = *((u8 *)saddr);
 

---
base-commit: cb560795c8c2ceca1d36a95f0d1b2eafc4074e37
change-id: 20241018-mctp-i2c-null-dest-a0ba271e0c48

Best regards,
-- 
Matt Johnston <matt@codeconstruct.com.au>

Re: [PATCH net] mctp i2c: handle NULL header address

[Simon Horman]

On Fri, Oct 18, 2024 at 11:07:56AM +0800, Matt Johnston via B4 Relay wrote:
> From: Matt Johnston <matt@codeconstruct.com.au>
> 
> daddr can be NULL if there is no neighbour table entry present,
> in that case the tx packet should be dropped.

Hi Matt,

Is there also a situation where saddr can be null?
The patch adds that check but it isn't mentioned here.

> 
> Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver")
> Cc: stable@vger.kernel.org
> Reported-by: Dung Cao <dung@os.amperecomputing.com>
> Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
> ---
>  drivers/net/mctp/mctp-i2c.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git drivers/net/mctp/mctp-i2c.c drivers/net/mctp/mctp-i2c.c
> index 4dc057c121f5..e70fb6687994 100644
> --- drivers/net/mctp/mctp-i2c.c
> +++ drivers/net/mctp/mctp-i2c.c

Unfortunately tooling expects an extra level of the directory hierarchy,
something like the following. And is unable to apply this patch in
it's current form.

diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c
index 4dc057c121f5..e70fb6687994 100644
--- a/drivers/net/mctp/mctp-i2c.c
+++ b/drivers/net/mctp/mctp-i2c.c

> @@ -588,6 +588,9 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev,
>  	if (len > MCTP_I2C_MAXMTU)
>  		return -EMSGSIZE;
>  
> +	if (!daddr || !saddr)
> +		return -EINVAL;
> +
>  	lldst = *((u8 *)daddr);
>  	llsrc = *((u8 *)saddr);
>  
> 
> ---

-- 
pw-bot: changes-requested

Re: [PATCH net] mctp i2c: handle NULL header address

[Matt Johnston]

Hi Simon,

On Fri, 2024-10-18 at 21:06 +0100, Simon Horman wrote:
> On Fri, Oct 18, 2024 at 11:07:56AM +0800, Matt Johnston via B4 Relay wrote:
> > From: Matt Johnston <matt@codeconstruct.com.au>
> > 
> > daddr can be NULL if there is no neighbour table entry present,
> > in that case the tx packet should be dropped.
> 
> Hi Matt,
> 
> Is there also a situation where saddr can be null?
> The patch adds that check but it isn't mentioned here.

AF_MCTP protocol will always have saddr set, but it may be possible to route 
other protocols out a mctp-i2c interface where saddr=NULL.
(Perhaps other protocols should be prevented separately?)
I'll update the commit message.

> > Fixes: f5b8abf9fc3d ("mctp i2c: MCTP I2C binding driver")
> > Cc: stable@vger.kernel.org
> > Reported-by: Dung Cao <dung@os.amperecomputing.com>
> > Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
> > ---
> >  drivers/net/mctp/mctp-i2c.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git drivers/net/mctp/mctp-i2c.c drivers/net/mctp/mctp-i2c.c
> > index 4dc057c121f5..e70fb6687994 100644
> > --- drivers/net/mctp/mctp-i2c.c
> > +++ drivers/net/mctp/mctp-i2c.c
> 
> Unfortunately tooling expects an extra level of the directory hierarchy,
> something like the following. And is unable to apply this patch in
> it's current form.

Sorry, this was my first time using b4 [1].

Cheers,
Matt

[1]
https://lore.kernel.org/tools/20241019-pr-diff-prefix-v1-1-435e6c256e2f@codeconstruct.com.au/T/#u

> 
> diff --git a/drivers/net/mctp/mctp-i2c.c b/drivers/net/mctp/mctp-i2c.c
> index 4dc057c121f5..e70fb6687994 100644
> --- a/drivers/net/mctp/mctp-i2c.c
> +++ b/drivers/net/mctp/mctp-i2c.c
> 
> > @@ -588,6 +588,9 @@ static int mctp_i2c_header_create(struct sk_buff *skb, struct net_device *dev,
> >  	if (len > MCTP_I2C_MAXMTU)
> >  		return -EMSGSIZE;
> >  
> > +	if (!daddr || !saddr)
> > +		return -EINVAL;
> > +
> >  	lldst = *((u8 *)daddr);
> >  	llsrc = *((u8 *)saddr);
> >  
> > 
> > ---
>