* Re: [PATCH] i40e: Fix potential invalid access when MAC list is empty
2025-08-27 3:23 [PATCH] i40e: Fix potential invalid access when MAC list is empty Zhen Ni
@ 2025-08-27 7:47 ` Przemek Kitszel
2025-08-27 11:56 ` [PATCH iwl-net v2] " Zhen Ni
2025-08-27 15:18 ` [Intel-wired-lan] [PATCH] " Paul Menzel
2 siblings, 0 replies; 5+ messages in thread
From: Przemek Kitszel @ 2025-08-27 7:47 UTC (permalink / raw)
To: Zhen Ni
Cc: intel-wired-lan, netdev, anthony.l.nguyen, andrew+netdev, davem,
edumazet, kuba, pabeni
On 8/27/25 05:23, Zhen Ni wrote:
> list_first_entry() never returns NULL — if the list is empty, it still
> returns a pointer to an invalid object, leading to potential invalid
> memory access when dereferenced.
>
> Fix this by checking list_empty() before calling list_first_entry(),
> and only copying the MAC address when the list is not empty.
good observation, thank you for reaching out!
what about using list_first_entry_or_null() instead of splitting into
two operations?
next time please tag intel ethernet patches as PATCH iwl-net (for fixes,
like here) or PATCH iwl-next (for features/refactors)
>
> Fixes: e3219ce6a775 ("i40e: Add support for client interface for IWARP driver")
> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
> ---
> drivers/net/ethernet/intel/i40e/i40e_client.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
> index 5f1a405cbbf8..0a72157aee0e 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_client.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
> @@ -359,12 +359,13 @@ static void i40e_client_add_instance(struct i40e_pf *pf)
> if (i40e_client_get_params(vsi, &cdev->lan_info.params))
> goto free_cdev;
>
> - mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
> - struct netdev_hw_addr, list);
> - if (mac)
> + if (!list_empty(&cdev->lan_info.netdev->dev_addrs.list)) {
> + mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
> + struct netdev_hw_addr, list);
> ether_addr_copy(cdev->lan_info.lanmac, mac->addr);
> - else
> + } else {
> dev_err(&pf->pdev->dev, "MAC address list is empty!\n");
> + }
>
> pf->cinst = cdev;
>
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH iwl-net v2] i40e: Fix potential invalid access when MAC list is empty
2025-08-27 3:23 [PATCH] i40e: Fix potential invalid access when MAC list is empty Zhen Ni
2025-08-27 7:47 ` Przemek Kitszel
@ 2025-08-27 11:56 ` Zhen Ni
2025-08-27 15:19 ` [Intel-wired-lan] " Paul Menzel
2025-08-27 15:18 ` [Intel-wired-lan] [PATCH] " Paul Menzel
2 siblings, 1 reply; 5+ messages in thread
From: Zhen Ni @ 2025-08-27 11:56 UTC (permalink / raw)
To: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev, davem,
edumazet, kuba, pabeni
Cc: intel-wired-lan, netdev, Zhen Ni
list_first_entry() never returns NULL — if the list is empty, it still
returns a pointer to an invalid object, leading to potential invalid
memory access when dereferenced.
Fix this by using list_first_entry_or_null instead of list_first_entry.
Fixes: e3219ce6a775 ("i40e: Add support for client interface for IWARP driver")
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
---
Changes in v2:
- Replace the list_empty() pre-check with list_first_entry_or_null()
---
drivers/net/ethernet/intel/i40e/i40e_client.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index 5f1a405cbbf8..518bc738ea3b 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -359,8 +359,8 @@ static void i40e_client_add_instance(struct i40e_pf *pf)
if (i40e_client_get_params(vsi, &cdev->lan_info.params))
goto free_cdev;
- mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
- struct netdev_hw_addr, list);
+ mac = list_first_entry_or_null(&cdev->lan_info.netdev->dev_addrs.list,
+ struct netdev_hw_addr, list);
if (mac)
ether_addr_copy(cdev->lan_info.lanmac, mac->addr);
else
--
2.20.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [Intel-wired-lan] [PATCH iwl-net v2] i40e: Fix potential invalid access when MAC list is empty
2025-08-27 11:56 ` [PATCH iwl-net v2] " Zhen Ni
@ 2025-08-27 15:19 ` Paul Menzel
0 siblings, 0 replies; 5+ messages in thread
From: Paul Menzel @ 2025-08-27 15:19 UTC (permalink / raw)
To: Zhen Ni
Cc: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev, davem,
edumazet, kuba, pabeni, intel-wired-lan, netdev
Dear Zhen,
Thank you for your patch.
Am 27.08.25 um 13:56 schrieb Zhen Ni:
> list_first_entry() never returns NULL — if the list is empty, it still
> returns a pointer to an invalid object, leading to potential invalid
> memory access when dereferenced.
>
> Fix this by using list_first_entry_or_null instead of list_first_entry.
>
> Fixes: e3219ce6a775 ("i40e: Add support for client interface for IWARP driver")
> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
> ---
> Changes in v2:
> - Replace the list_empty() pre-check with list_first_entry_or_null()
> ---
> drivers/net/ethernet/intel/i40e/i40e_client.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
> index 5f1a405cbbf8..518bc738ea3b 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_client.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
> @@ -359,8 +359,8 @@ static void i40e_client_add_instance(struct i40e_pf *pf)
> if (i40e_client_get_params(vsi, &cdev->lan_info.params))
> goto free_cdev;
>
> - mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
> - struct netdev_hw_addr, list);
> + mac = list_first_entry_or_null(&cdev->lan_info.netdev->dev_addrs.list,
> + struct netdev_hw_addr, list);
> if (mac)
> ether_addr_copy(cdev->lan_info.lanmac, mac->addr);
> else
That’s even better.
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Kind regards,
Paul
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Intel-wired-lan] [PATCH] i40e: Fix potential invalid access when MAC list is empty
2025-08-27 3:23 [PATCH] i40e: Fix potential invalid access when MAC list is empty Zhen Ni
2025-08-27 7:47 ` Przemek Kitszel
2025-08-27 11:56 ` [PATCH iwl-net v2] " Zhen Ni
@ 2025-08-27 15:18 ` Paul Menzel
2 siblings, 0 replies; 5+ messages in thread
From: Paul Menzel @ 2025-08-27 15:18 UTC (permalink / raw)
To: Zhen Ni
Cc: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev, davem,
edumazet, kuba, pabeni, intel-wired-lan, netdev
Dear Zhen,
Thank you for your patch.
Am 27.08.25 um 05:23 schrieb Zhen Ni:
> list_first_entry() never returns NULL — if the list is empty, it still
> returns a pointer to an invalid object, leading to potential invalid
> memory access when dereferenced.
>
> Fix this by checking list_empty() before calling list_first_entry(),
> and only copying the MAC address when the list is not empty.
>
> Fixes: e3219ce6a775 ("i40e: Add support for client interface for IWARP driver")
> Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
> ---
> drivers/net/ethernet/intel/i40e/i40e_client.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
> index 5f1a405cbbf8..0a72157aee0e 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_client.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
> @@ -359,12 +359,13 @@ static void i40e_client_add_instance(struct i40e_pf *pf)
> if (i40e_client_get_params(vsi, &cdev->lan_info.params))
> goto free_cdev;
>
> - mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
> - struct netdev_hw_addr, list);
> - if (mac)
> + if (!list_empty(&cdev->lan_info.netdev->dev_addrs.list)) {
> + mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list,
> + struct netdev_hw_addr, list);
> ether_addr_copy(cdev->lan_info.lanmac, mac->addr);
> - else
> + } else {
> dev_err(&pf->pdev->dev, "MAC address list is empty!\n");
> + }
>
> pf->cinst = cdev;
>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Kind regards,
Paul
^ permalink raw reply [flat|nested] 5+ messages in thread