Re: [PATCH for 6.0] net: check the existence of peer before trying to pad

[Jason Wang <jasowang@redhat.com>]

在 2021/4/23 下午1:42, Stefan Weil 写道:
> Am 23.04.21 um 05:18 schrieb Jason Wang:
>
>> There could be case that peer is NULL. This can happen when during
>> network device hot-add where net device needs to be added first. So
>> the patch check the existence of peer before trying to do the pad.
>>
>> Fixes: 969e50b61a285 ("net: Pad short frames to minimum size before 
>> sending from SLiRP/TAP")
>> Signed-off-by: Jason Wang <jasowang@redhat.com>
>> ---
>>   include/net/net.h | 5 +++++
>>   net/slirp.c       | 2 +-
>>   net/tap-win32.c   | 2 +-
>>   net/tap.c         | 2 +-
>>   4 files changed, 8 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/net/net.h b/include/net/net.h
>> index eff24519d2..1ef536d771 100644
>> --- a/include/net/net.h
>> +++ b/include/net/net.h
>> @@ -241,4 +241,9 @@ uint32_t net_crc32_le(const uint8_t *p, int len);
>>       .offset     = vmstate_offset_macaddr(_state, _field), 
> \
>>   }
>>   +static inline bool net_peer_needs_padding(NetClientState *nc)
>> +{
>> +  return nc->peer && !nc->peer->do_not_pad;
>> +}
>> +
>>   #endif
>> diff --git a/net/slirp.c b/net/slirp.c
>> index a01a0fccd3..7a4e96db5c 100644
>> --- a/net/slirp.c
>> +++ b/net/slirp.c
>> @@ -119,7 +119,7 @@ static ssize_t net_slirp_send_packet(const void 
>> *pkt,size_t pkt_len,
>>       uint8_t min_pkt[ETH_ZLEN];
>>       size_t min_pktsz = sizeof(min_pkt);
>>   -    if (!s->nc.peer->do_not_pad) {
>> +    if (net_peer_needs_padding(&s->nc)) {
>>           if (eth_pad_short_frame(min_pkt, &min_pktsz, pkt, pkt_len)) {
>>               pkt = min_pkt;
>>               pkt_len = min_pktsz;
>> diff --git a/net/tap-win32.c b/net/tap-win32.c
>> index 897bd18e32..6096972f5d 100644
>> --- a/net/tap-win32.c
>> +++ b/net/tap-win32.c
>> @@ -696,7 +696,7 @@ static void tap_win32_send(void *opaque)
>>       if (size > 0) {
>>           orig_buf = buf;
>>   -        if (!s->nc.peer->do_not_pad) {
>> +        if (net_peer_needs_padding(&s->nc)) {
>>               if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
>>                   buf = min_pkt;
>>                   size = min_pktsz;
>> diff --git a/net/tap.c b/net/tap.c
>> index 7d53cedaec..820872fde8 100644
>> --- a/net/tap.c
>> +++ b/net/tap.c
>> @@ -203,7 +203,7 @@ static void tap_send(void *opaque)
>>               size -= s->host_vnet_hdr_len;
>>           }
>>   -        if (!s->nc.peer->do_not_pad) {
>> +        if (net_peer_needs_padding(&s->nc)) {
>>               if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
>>                   buf = min_pkt;
>>                   size = min_pktsz;
>
>
> I assume that you had a test case which triggered that null pointer 
> access?


Yes, it's simple to trigger by just adding a tap device and assign an IP 
to that.

Thanks


> If yes, than this should indeed be applied before releasing 6.0.
>
> The modification is simple enough for a last minute change.
>
> Reviewed-by: Stefan Weil <sw@weilnetz.de>
>
>
>
>