[PATCH] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()

[PATCH] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()

[Haoxiang Li]

Add check for the return value of devm_kmemdup()
to prevent potential null pointer dereference.

Fixes: 2ffd87d38d6b ("ice: Move support DDP code out of ice_flex_pipe.c")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
 drivers/net/ethernet/intel/ice/ice_ddp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c
index 59323c019544..351824dc3c62 100644
--- a/drivers/net/ethernet/intel/ice/ice_ddp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ddp.c
@@ -2301,6 +2301,8 @@ enum ice_ddp_state ice_copy_and_init_pkg(struct ice_hw *hw, const u8 *buf,
 		return ICE_DDP_PKG_ERR;
 
 	buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL);
+	if (!buf_copy)
+		return ICE_DDP_PKG_ERR;
 
 	state = ice_init_pkg(hw, buf_copy, len);
 	if (!ice_is_init_pkg_successful(state)) {
-- 
2.25.1

Re: [PATCH] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()

[Michal Swiatkowski]

On Sat, May 24, 2025 at 03:26:58PM +0800, Haoxiang Li wrote:
> Add check for the return value of devm_kmemdup()
> to prevent potential null pointer dereference.
> 
> Fixes: 2ffd87d38d6b ("ice: Move support DDP code out of ice_flex_pipe.c")

This commit is only moving the code to new file. I think it should be:
c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download")

> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
> ---
>  drivers/net/ethernet/intel/ice/ice_ddp.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c
> index 59323c019544..351824dc3c62 100644
> --- a/drivers/net/ethernet/intel/ice/ice_ddp.c
> +++ b/drivers/net/ethernet/intel/ice/ice_ddp.c
> @@ -2301,6 +2301,8 @@ enum ice_ddp_state ice_copy_and_init_pkg(struct ice_hw *hw, const u8 *buf,
>  		return ICE_DDP_PKG_ERR;
>  
>  	buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL);
> +	if (!buf_copy)
> +		return ICE_DDP_PKG_ERR;

Fix looks fine, thanks
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>

>  
>  	state = ice_init_pkg(hw, buf_copy, len);
>  	if (!ice_is_init_pkg_successful(state)) {
> -- 
> 2.25.1

RE: [Intel-wired-lan] [PATCH] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Haoxiang Li
> Sent: Saturday, May 24, 2025 9:27 AM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; andrew+netdev@lunn.ch;
> davem@davemloft.net; edumazet@google.com; kuba@kernel.org;
> pabeni@redhat.com; Temerkhanov, Sergey <sergey.temerkhanov@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; Haoxiang Li <haoxiang_li2024@163.com>;
> stable@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH] ice: Fix a null pointer dereference
> in ice_copy_and_init_pkg()
> 
> Add check for the return value of devm_kmemdup() to prevent potential
> null pointer dereference.
> 
> Fixes: 2ffd87d38d6b ("ice: Move support DDP code out of
> ice_flex_pipe.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

> ---
>  drivers/net/ethernet/intel/ice/ice_ddp.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c
> b/drivers/net/ethernet/intel/ice/ice_ddp.c
> index 59323c019544..351824dc3c62 100644
> --- a/drivers/net/ethernet/intel/ice/ice_ddp.c
> +++ b/drivers/net/ethernet/intel/ice/ice_ddp.c
> @@ -2301,6 +2301,8 @@ enum ice_ddp_state ice_copy_and_init_pkg(struct
> ice_hw *hw, const u8 *buf,
>  		return ICE_DDP_PKG_ERR;
> 
>  	buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len,
> GFP_KERNEL);
> +	if (!buf_copy)
> +		return ICE_DDP_PKG_ERR;
> 
>  	state = ice_init_pkg(hw, buf_copy, len);
>  	if (!ice_is_init_pkg_successful(state)) {
> --
> 2.25.1