lkml.org 
[lkml]   [2021]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 087/121] net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
    Date
    From: Karsten Graul <kgraul@linux.ibm.com>

    [ Upstream commit 587acad41f1bc48e16f42bb2aca63bf323380be8 ]

    Coverity reports a possible NULL dereferencing problem:

    in smc_vlan_by_tcpsk():
    6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times).
    7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next.
    1623 ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
    CID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS)
    8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev.
    1624 if (is_vlan_dev(ndev)) {

    Remove the manual implementation and use netdev_walk_all_lower_dev() to
    iterate over the lower devices. While on it remove an obsolete function
    parameter comment.

    Fixes: cb9d43f67754 ("net/smc: determine vlan_id of stacked net_device")
    Suggested-by: Julian Wiedmann <jwi@linux.ibm.com>
    Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/smc/smc_core.c | 35 ++++++++++++++++++-----------------
    1 file changed, 18 insertions(+), 17 deletions(-)

    diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
    index 109d790eaebe2..cd625b672429f 100644
    --- a/net/smc/smc_core.c
    +++ b/net/smc/smc_core.c
    @@ -1209,14 +1209,26 @@ static void smc_link_down_work(struct work_struct *work)
    mutex_unlock(&lgr->llc_conf_mutex);
    }

    -/* Determine vlan of internal TCP socket.
    - * @vlan_id: address to store the determined vlan id into
    - */
    +static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,
    + struct netdev_nested_priv *priv)
    +{
    + unsigned short *vlan_id = (unsigned short *)priv->data;
    +
    + if (is_vlan_dev(lower_dev)) {
    + *vlan_id = vlan_dev_vlan_id(lower_dev);
    + return 1;
    + }
    +
    + return 0;
    +}
    +
    +/* Determine vlan of internal TCP socket. */
    int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
    {
    struct dst_entry *dst = sk_dst_get(clcsock->sk);
    + struct netdev_nested_priv priv;
    struct net_device *ndev;
    - int i, nest_lvl, rc = 0;
    + int rc = 0;

    ini->vlan_id = 0;
    if (!dst) {
    @@ -1234,20 +1246,9 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
    goto out_rel;
    }

    + priv.data = (void *)&ini->vlan_id;
    rtnl_lock();
    - nest_lvl = ndev->lower_level;
    - for (i = 0; i < nest_lvl; i++) {
    - struct list_head *lower = &ndev->adj_list.lower;
    -
    - if (list_empty(lower))
    - break;
    - lower = lower->next;
    - ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
    - if (is_vlan_dev(ndev)) {
    - ini->vlan_id = vlan_dev_vlan_id(ndev);
    - break;
    - }
    - }
    + netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv);
    rtnl_unlock();

    out_rel:
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-29 19:40    [W:3.742 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site