[PATCH 5.10 0/1] eth: ena: Check return value of xdp_convert_buff_to_frame

[PATCH 5.10 0/1] eth: ena: Check return value of xdp_convert_buff_to_frame

[Peter Kosyh]

Return value of a function 'xdp_convert_buff_to_frame' is dereferenced
without checking for null, but it is usually checked for this function.

This fixed in upstream commit <e8223eeff02> while refactoring. So,
simpler patch is offered for a stable version.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

[PATCH 5.10 1/1] eth: ena: Check return value of xdp_convert_buff_to_frame

[Peter Kosyh]

Return value of a function 'xdp_convert_buff_to_frame' is dereferenced
without checking for null, but it is usually checked for this function.

This fixed in upstream commit <e8223eeff02> while refactoring.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Peter Kosyh <pkosyh@yandex.ru>
---
 drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
index 52414ac2c901..9e6b2bd73dac 100644
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -237,6 +237,8 @@ static int ena_xdp_tx_map_buff(struct ena_ring *xdp_ring,
 	u32 size;
 
 	tx_info->xdpf = xdp_convert_buff_to_frame(xdp);
+	if (unlikely(!tx_info->xdpf))
+		goto error_report_dma_error;
 	size = tx_info->xdpf->len;
 	ena_buf = tx_info->bufs;
 
-- 
2.37.0

Re: [PATCH 5.10 1/1] eth: ena: Check return value of xdp_convert_buff_to_frame

[Greg Kroah-Hartman]

On Mon, Oct 03, 2022 at 02:48:19PM +0300, Peter Kosyh wrote:
> Return value of a function 'xdp_convert_buff_to_frame' is dereferenced
> without checking for null, but it is usually checked for this function.
> 
> This fixed in upstream commit <e8223eeff02> while refactoring.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Signed-off-by: Peter Kosyh <pkosyh@yandex.ru>
> ---
>  drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
> index 52414ac2c901..9e6b2bd73dac 100644
> --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
> +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
> @@ -237,6 +237,8 @@ static int ena_xdp_tx_map_buff(struct ena_ring *xdp_ring,
>  	u32 size;
>  
>  	tx_info->xdpf = xdp_convert_buff_to_frame(xdp);
> +	if (unlikely(!tx_info->xdpf))
> +		goto error_report_dma_error;
>  	size = tx_info->xdpf->len;
>  	ena_buf = tx_info->bufs;
>  
> -- 
> 2.37.0
> 

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

Re: [PATCH 5.10 1/1] eth: ena: Check return value of xdp_convert_buff_to_frame

[Greg Kroah-Hartman]

On Mon, Oct 03, 2022 at 03:59:08PM +0200, Greg Kroah-Hartman wrote:
> On Mon, Oct 03, 2022 at 02:48:19PM +0300, Peter Kosyh wrote:
> > Return value of a function 'xdp_convert_buff_to_frame' is dereferenced
> > without checking for null, but it is usually checked for this function.
> > 
> > This fixed in upstream commit <e8223eeff02> while refactoring.
> > 
> > Found by Linux Verification Center (linuxtesting.org) with SVACE.
> > 
> > Signed-off-by: Peter Kosyh <pkosyh@yandex.ru>
> > ---
> >  drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
> > index 52414ac2c901..9e6b2bd73dac 100644
> > --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
> > +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
> > @@ -237,6 +237,8 @@ static int ena_xdp_tx_map_buff(struct ena_ring *xdp_ring,
> >  	u32 size;
> >  
> >  	tx_info->xdpf = xdp_convert_buff_to_frame(xdp);
> > +	if (unlikely(!tx_info->xdpf))
> > +		goto error_report_dma_error;
> >  	size = tx_info->xdpf->len;
> >  	ena_buf = tx_info->bufs;
> >  
> > -- 
> > 2.37.0
> > 
> 
> <formletter>
> 
> This is not the correct way to submit patches for inclusion in the
> stable kernel tree.  Please read:
>     https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> for how to do this properly.
> 
> </formletter>

To be specific, why is this non-upstream commit really needed?  Can
xdp_convert_buff_to_frame() ever fail under normal operation?  Why was
this one commit picked?  And always properly reference commits in
changelog text as the documentation asks you to.

Also, you didn't cc: everyone involved in the original commit, nor
showed how you tested this in anyway (hint, read
Documentation/process/researcher-guidelines.rst)

thanks,

greg k-h