From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9AC2C10DC1 for ; Mon, 4 Dec 2023 16:07:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344502AbjLDQHg (ORCPT ); Mon, 4 Dec 2023 11:07:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33670 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234949AbjLDQHe (ORCPT ); Mon, 4 Dec 2023 11:07:34 -0500 Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67CAACA; Mon, 4 Dec 2023 08:07:39 -0800 (PST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 3B4CxuPc022087; Mon, 4 Dec 2023 08:06:52 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=message-id : date : mime-version : subject : to : cc : references : from : in-reply-to : content-type : content-transfer-encoding; s=pfpt0220; bh=UxGwEKMqb77hSj2gwUSJa6e+ATYUziz0FtksrLEqbDc=; b=aL+XXb5QHCpAsH44dhOEFE9kyihBRMnyEqQTS4uv+EVfGFJ5Pl55D0OMMantvZrk4aij MZLeQ8FZUuKO6IFisV+MG2QPPxgEnU6OXmPFvvtf1m403X85LT4KRcrRhz9DLus8PANI /s6il0mqas8CXq49KYf11D8E5WvamZr6lCF+jmzrMcCpsAAaQF2hhYWjK7vstV8fwQOM x1Map7hQpR0RiItiUz3vwHRfX4qcqyYudtDc/dVRLSh7J2MI6dF6mwLGBnr5dayFkz0Z ArUZ0FY96KIzXZ9rW9sfaKRe8V6DmAskD8O31FlAOLcxdE1JXUtDgxiRTz3uUIw2rx0p GQ== Received: from dc5-exch01.marvell.com ([199.233.59.181]) by mx0a-0016f401.pphosted.com (PPS) with ESMTPS id 3ur2tvdxt3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 04 Dec 2023 08:06:51 -0800 Received: from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.48; Mon, 4 Dec 2023 08:06:50 -0800 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.48 via Frontend Transport; Mon, 4 Dec 2023 08:06:50 -0800 Received: from [10.9.8.90] (OBi302.marvell.com [10.9.8.90]) by maili.marvell.com (Postfix) with ESMTP id DA6AA3F7057; Mon, 4 Dec 2023 08:06:46 -0800 (PST) Message-ID: <08ae0a18-669e-b479-94d4-450a7a12efe9@marvell.com> Date: Mon, 4 Dec 2023 17:06:46 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [EXT] [PATCH] net: atlantic: Fix NULL dereference of skb pointer in To: Daniil Maximov CC: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Richard Cochran , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , Taehee Yoo , Alexey Khoroshilov , , , , References: <20231204085810.1681386-1-daniil31415it@gmail.com> Content-Language: en-US From: Igor Russkikh In-Reply-To: <20231204085810.1681386-1-daniil31415it@gmail.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Proofpoint-ORIG-GUID: 4kUdbOM2gkTdP-w4txwaAiQJ8EVdSGKm X-Proofpoint-GUID: 4kUdbOM2gkTdP-w4txwaAiQJ8EVdSGKm X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.997,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2023-12-04_15,2023-12-04_01,2023-05-22_02 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Daniil, > If is_ptp_ring == true in the loop of __aq_ring_xdp_clean function, > then a timestamp is stored from a packet in a field of skb object, > which is not allocated at the moment of the call (skb == NULL). > > Generalize aq_ptp_extract_ts and other affected functions so they don't > work with struct sk_buff*, but with struct skb_shared_hwtstamps*. > > Found by Linux Verification Center (linuxtesting.org) with SVACE Thanks for finding this and working on this. Have you reproduced it in wild, or this just comes out of static analysis? I'm asking because looking into the flow you described - it looks like XDP mode should immediately fail with null pointer access on any rx traffic. But that was never reported. I will try to debug and validate the fix, but this may take some time. So for now Reviewed-by: Igor Russkikh Thanks Igor