From: Simon Horman <horms@kernel.org>
To: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
Cc: intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
Madhu Chititm <madhu.chittim@intel.com>
Subject: Re: [PATCH iwl-net] idpf: fix null-ptr-deref in idpf_features_check
Date: Tue, 15 Apr 2025 16:46:20 +0100 [thread overview]
Message-ID: <20250415154620.GY395307@horms.kernel.org> (raw)
In-Reply-To: <20250411160035.9155-1-pavan.kumar.linga@intel.com>
On Fri, Apr 11, 2025 at 09:00:35AM -0700, Pavan Kumar Linga wrote:
> idpf_features_check is used to validate the TX packet. skb header
> length is compared with the hardware supported value received from
> the device control plane. The value is stored in the adapter structure
> and to access it, vport pointer is used. During reset all the vports
> are released and the vport pointer that the netdev private structure
> points to is NULL.
>
> To avoid null-ptr-deref, store the max header length value in netdev
> private structure. This also helps to cache the value and avoid
> accessing adapter pointer in hot path.
>
> BUG: kernel NULL pointer dereference, address: 0000000000000068
> ...
> RIP: 0010:idpf_features_check+0x6d/0xe0 [idpf]
> Call Trace:
> <TASK>
> ? __die+0x23/0x70
> ? page_fault_oops+0x154/0x520
> ? exc_page_fault+0x76/0x190
> ? asm_exc_page_fault+0x26/0x30
> ? idpf_features_check+0x6d/0xe0 [idpf]
> netif_skb_features+0x88/0x310
> validate_xmit_skb+0x2a/0x2b0
> validate_xmit_skb_list+0x4c/0x70
> sch_direct_xmit+0x19d/0x3a0
> __dev_queue_xmit+0xb74/0xe70
> ...
>
> Fixes: a251eee62133 ("idpf: add SRIOV support and other ndo_ops")
> Reviewed-by: Madhu Chititm <madhu.chittim@intel.com>
> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
next prev parent reply other threads:[~2025-04-15 15:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-11 16:00 [PATCH iwl-net] idpf: fix null-ptr-deref in idpf_features_check Pavan Kumar Linga
2025-04-15 15:46 ` Simon Horman [this message]
2025-05-06 22:10 ` [Intel-wired-lan] " Salin, Samuel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250415154620.GY395307@horms.kernel.org \
--to=horms@kernel.org \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=madhu.chittim@intel.com \
--cc=netdev@vger.kernel.org \
--cc=pavan.kumar.linga@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).