[PATCH net] net: sxgbe: fix potential NULL dereference in sxgbe_rx()

[PATCH net] net: sxgbe: fix potential NULL dereference in sxgbe_rx()

[Alexey Kodanev]

Currently, when skb is null, the driver prints an error and then
dereferences skb on the next line.

To fix this, let's add a 'break' after the error message to switch
to sxgbe_rx_refill(), which is similar to the approach taken by the
other drivers in this particular case, e.g. calxeda with xgmac_rx().

Found during a code review.

Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
---
 drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 75bad561b352..849c5a6c2af1 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -1521,8 +1521,10 @@ static int sxgbe_rx(struct sxgbe_priv_data *priv, int limit)
 
 		skb = priv->rxq[qnum]->rx_skbuff[entry];
 
-		if (unlikely(!skb))
+		if (unlikely(!skb)) {
 			netdev_err(priv->dev, "rx descriptor is not consistent\n");
+			break;
+		}
 
 		prefetch(skb->data - NET_IP_ALIGN);
 		priv->rxq[qnum]->rx_skbuff[entry] = NULL;
-- 
2.25.1

Re: [PATCH net] net: sxgbe: fix potential NULL dereference in sxgbe_rx()

[Simon Horman]

On Fri, Nov 21, 2025 at 12:38:34PM +0000, Alexey Kodanev wrote:
> Currently, when skb is null, the driver prints an error and then
> dereferences skb on the next line.
> 
> To fix this, let's add a 'break' after the error message to switch
> to sxgbe_rx_refill(), which is similar to the approach taken by the
> other drivers in this particular case, e.g. calxeda with xgmac_rx().
> 
> Found during a code review.
> 
> Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver")
> Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>

Thanks Alexey,

I think this is a case where it is hard to know the true effects
without running the system. But I'm assuming that we aren't in
a position to do so. So instead we need to try to reason at
the code level.

From that perspective I do see that:
1. Without this change there will be a NULL pointer dereference *boob*
2. It seems that the refill logic should work with the proposed solution

So, I do expect this helps.
And I do think it can be accepted without hw testing.
But I do have a lower confidence level than I would if there
was hw testing.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net] net: sxgbe: fix potential NULL dereference in sxgbe_rx()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 21 Nov 2025 12:38:34 +0000 you wrote:
> Currently, when skb is null, the driver prints an error and then
> dereferences skb on the next line.
> 
> To fix this, let's add a 'break' after the error message to switch
> to sxgbe_rx_refill(), which is similar to the approach taken by the
> other drivers in this particular case, e.g. calxeda with xgmac_rx().
> 
> [...]

Here is the summary with links:
  - [net] net: sxgbe: fix potential NULL dereference in sxgbe_rx()
    https://git.kernel.org/netdev/net/c/f5bce28f6b91

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html