From patchwork Wed Sep 1 12:27:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 505585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE303C432BE for ; Wed, 1 Sep 2021 12:44:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D4F5A61131 for ; Wed, 1 Sep 2021 12:44:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344685AbhIAMpl (ORCPT ); Wed, 1 Sep 2021 08:45:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:43544 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345276AbhIAMmz (ORCPT ); Wed, 1 Sep 2021 08:42:55 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id D2C7D61207; Wed, 1 Sep 2021 12:38:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1630499889; bh=dVkNF5RLoDqMfNKE7FzU+5N5tY8h+mel0CLlKqy+e6s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K9NF6JNw6PLL1ff3fAhvIO94BV7DWI9bW7kCOYE1Hwjv3q84uosHyGnNbpZZwGRMO rpL6Wu9jsZdT6MYhqwd+mLPCzbV42y9s7jF0UFZCT55+IkeBAsYxvJm7ltv3COAPrB v5VXHARNcHaVuoj1uzb7QnTFANy36RFAwo78B/us= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ong Boon Leong , Song Yoong Siang , "David S. Miller" Subject: [PATCH 5.13 022/113] net: stmmac: fix kernel panic due to NULL pointer dereference of buf->xdp Date: Wed, 1 Sep 2021 14:27:37 +0200 Message-Id: <20210901122302.721001578@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210901122301.984263453@linuxfoundation.org> References: <20210901122301.984263453@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Song Yoong Siang commit 2b9fff64f03219d78044d1ab40dde8e3d42e968a upstream. Ensure a valid XSK buffer before proceed to free the xdp buffer. The following kernel panic is observed without this patch: RIP: 0010:xp_free+0x5/0x40 Call Trace: stmmac_napi_poll_rxtx+0x332/0xb30 [stmmac] ? stmmac_tx_timer+0x3c/0xb0 [stmmac] net_rx_action+0x13d/0x3d0 __do_softirq+0xfc/0x2fb ? smpboot_register_percpu_thread+0xe0/0xe0 run_ksoftirqd+0x32/0x70 smpboot_thread_fn+0x1d8/0x2c0 kthread+0x169/0x1a0 ? kthread_park+0x90/0x90 ret_from_fork+0x1f/0x30 ---[ end trace 0000000000000002 ]--- Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy") Cc: # 5.13.x Suggested-by: Ong Boon Leong Signed-off-by: Song Yoong Siang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -4925,6 +4925,10 @@ read_again: prefetch(np); + /* Ensure a valid XSK buffer before proceed */ + if (!buf->xdp) + break; + if (priv->extend_desc) stmmac_rx_extended_status(priv, &priv->dev->stats, &priv->xstats, @@ -4945,10 +4949,6 @@ read_again: continue; } - /* Ensure a valid XSK buffer before proceed */ - if (!buf->xdp) - break; - /* XSK pool expects RX frame 1:1 mapped to XSK buffer */ if (likely(status & rx_not_ls)) { xsk_buff_free(buf->xdp);