[PATCH] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[PATCH] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Miaoqian Lin]

Replace NULL check with IS_ERR() check after calling page_pool_create()
since this function returns error pointers (ERR_PTR).
Using NULL check could lead to invalid pointer dereference.

Fixes: 8533b14b3d65 ("eth: mlx4: create a page pool for Rx")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
 drivers/net/ethernet/mellanox/mlx4/en_rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 92a16ddb7d86..b60f3d5fbd16 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -267,7 +267,7 @@ int mlx4_en_create_rx_ring(struct mlx4_en_priv *priv,
 	pp.dma_dir = priv->dma_dir;
 
 	ring->pp = page_pool_create(&pp);
-	if (!ring->pp)
+	if (IS_ERR(ring->pp))
 		goto err_ring;
 
 	if (xdp_rxq_info_reg(&ring->xdp_rxq, priv->dev, queue_index, 0) < 0)
-- 
2.25.1

Re: [PATCH] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Simon Horman]

On Tue, Aug 05, 2025 at 06:50:57AM +0400, Miaoqian Lin wrote:
> Replace NULL check with IS_ERR() check after calling page_pool_create()
> since this function returns error pointers (ERR_PTR).
> Using NULL check could lead to invalid pointer dereference.
> 
> Fixes: 8533b14b3d65 ("eth: mlx4: create a page pool for Rx")
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Jakub Kicinski]

On Tue,  5 Aug 2025 06:50:57 +0400 Miaoqian Lin wrote:
>  	ring->pp = page_pool_create(&pp);
> -	if (!ring->pp)
> +	if (IS_ERR(ring->pp))
>  		goto err_ring;

Thanks for fixing! Looks we previously depended on err being initialized
to -ENOMEM, but since we have an errno now, I think it'd be better to
use it:

	if (IS_ERR(ring->pp)) {
		err = PTR_ERR(ring->pp);
		goto err_ring;
	}

Re: [PATCH] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Tariq Toukan]

On 06/08/2025 2:09, Jakub Kicinski wrote:
> On Tue,  5 Aug 2025 06:50:57 +0400 Miaoqian Lin wrote:
>>   	ring->pp = page_pool_create(&pp);
>> -	if (!ring->pp)
>> +	if (IS_ERR(ring->pp))
>>   		goto err_ring;
> 
> Thanks for fixing! Looks we previously depended on err being initialized
> to -ENOMEM, but since we have an errno now, I think it'd be better to
> use it:
> 
> 	if (IS_ERR(ring->pp)) {
> 		err = PTR_ERR(ring->pp);
> 		goto err_ring;
> 	}
> 

+1

[PATCH v2] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Miaoqian Lin]

Replace NULL check with IS_ERR() check after calling page_pool_create()
since this function returns error pointers (ERR_PTR).
Using NULL check could lead to invalid pointer dereference.

Fixes: 8533b14b3d65 ("eth: mlx4: create a page pool for Rx")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
Changes in v2:
use err = PTR_ERR(ring->pp);
v1 link: https://lore.kernel.org/all/20250805025057.3659898-1-linmq006@gmail.com
---
 drivers/net/ethernet/mellanox/mlx4/en_rx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 92a16ddb7d86..13666d50b90f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -267,8 +267,10 @@ int mlx4_en_create_rx_ring(struct mlx4_en_priv *priv,
    pp.dma_dir = priv->dma_dir;
 
    ring->pp = page_pool_create(&pp);
-   if (!ring->pp)
+   if (IS_ERR(ring->pp)) {
+       err = PTR_ERR(ring->pp);
        goto err_ring;
+   }
 
    if (xdp_rxq_info_reg(&ring->xdp_rxq, priv->dev, queue_index, 0) < 0)
        goto err_pp;
-- 
2.25.1

Re: [PATCH v2] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Jakub Kicinski]

On Mon, 18 Aug 2025 00:38:30 +0800 Miaoqian Lin wrote:
> Replace NULL check with IS_ERR() check after calling page_pool_create()
> since this function returns error pointers (ERR_PTR).
> Using NULL check could lead to invalid pointer dereference.

The v2 patch is white-space corrupted. The v1 was fine, so maybe try to
send it the way you send the v1?
Please do *not* try to send the new version of the patch in reply to
the thread of v1. The link to v1 you put in the changelog is enough.
-- 
pw-bot: cr