[PATCH v3] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[PATCH v3] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Miaoqian Lin]

Replace NULL check with IS_ERR() check after calling page_pool_create()
since this function returns error pointers (ERR_PTR).
Using NULL check could lead to invalid pointer dereference.

Fixes: 8533b14b3d65 ("eth: mlx4: create a page pool for Rx")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
----
Changes in v3:
- fix IS_ERR
Changes in v2:
- use err = PTR_ERR(ring->pp);
v1 link: https://lore.kernel.org/all/20250805025057.3659898-1-linmq006@gmail.com
v2 link: https://lore.kernel.org/all/20250828065050.21954-1-linmq006@gmail.com
---
 drivers/net/ethernet/mellanox/mlx4/en_rx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
index 92a16ddb7d86..13666d50b90f 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
@@ -267,8 +267,10 @@ int mlx4_en_create_rx_ring(struct mlx4_en_priv *priv,
 	pp.dma_dir = priv->dma_dir;
 
 	ring->pp = page_pool_create(&pp);
-	if (!ring->pp)
+	if (IS_ERR(ring->pp)) {
+		err = PTR_ERR(ring->pp);
 		goto err_ring;
+	}
 
 	if (xdp_rxq_info_reg(&ring->xdp_rxq, priv->dev, queue_index, 0) < 0)
 		goto err_pp;
-- 
2.39.5 (Apple Git-154)

Re: [PATCH v3] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[Vadim Fedorenko]

On 28/08/2025 13:18, Miaoqian Lin wrote:
> Replace NULL check with IS_ERR() check after calling page_pool_create()
> since this function returns error pointers (ERR_PTR).
> Using NULL check could lead to invalid pointer dereference.
> 
> Fixes: 8533b14b3d65 ("eth: mlx4: create a page pool for Rx")
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> ----
> Changes in v3:
> - fix IS_ERR
> Changes in v2:
> - use err = PTR_ERR(ring->pp);
> v1 link: https://lore.kernel.org/all/20250805025057.3659898-1-linmq006@gmail.com
> v2 link: https://lore.kernel.org/all/20250828065050.21954-1-linmq006@gmail.com
> ---
>   drivers/net/ethernet/mellanox/mlx4/en_rx.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
> index 92a16ddb7d86..13666d50b90f 100644
> --- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
> +++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
> @@ -267,8 +267,10 @@ int mlx4_en_create_rx_ring(struct mlx4_en_priv *priv,
>   	pp.dma_dir = priv->dma_dir;
>   
>   	ring->pp = page_pool_create(&pp);
> -	if (!ring->pp)
> +	if (IS_ERR(ring->pp)) {
> +		err = PTR_ERR(ring->pp);
>   		goto err_ring;
> +	}
>   
>   	if (xdp_rxq_info_reg(&ring->xdp_rxq, priv->dev, queue_index, 0) < 0)
>   		goto err_pp;

You should wait for 24h before submission of the next version. That's a 
general rule for netdev.

But given that this change is quite small...

Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>

Re: [PATCH v3] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 28 Aug 2025 20:18:58 +0800 you wrote:
> Replace NULL check with IS_ERR() check after calling page_pool_create()
> since this function returns error pointers (ERR_PTR).
> Using NULL check could lead to invalid pointer dereference.
> 
> Fixes: 8533b14b3d65 ("eth: mlx4: create a page pool for Rx")
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> 
> [...]

Here is the summary with links:
  - [v3] eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring
    https://git.kernel.org/netdev/net/c/e580beaf43d5

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html