Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9fe06a51 authored by Colin Ian King's avatar Colin Ian King Committed by Jeff Kirsher
Browse files

iavf: fix dereference of null rx_buffer pointer 



A recent commit efa14c39 ("iavf: allow null RX descriptors") added
a null pointer sanity check on rx_buffer, however, rx_buffer is being
dereferenced before that check, which implies a null pointer dereference
bug can potentially occur.  Fix this by only dereferencing rx_buffer
until after the null pointer check.

Addresses-Coverity: ("Dereference before null check")
Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent cd502a7f

drivers/net/ethernet/intel/iavf/iavf_txrx.c

+4 −2
Original line number Diff line number Diff line
@@ -1296,7 +1296,7 @@ static struct sk_buff *iavf_construct_skb(struct iavf_ring *rx_ring, 
					  struct iavf_rx_buffer *rx_buffer,

					  unsigned int size)

{

	void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;

	void *va;

#if (PAGE_SIZE < 8192)

	unsigned int truesize = iavf_rx_pg_size(rx_ring) / 2;

#else
@@ -1308,6 +1308,7 @@ static struct sk_buff *iavf_construct_skb(struct iavf_ring *rx_ring, 
	if (!rx_buffer)

		return NULL;

	/* prefetch first cache line of first page */

	va = page_address(rx_buffer->page) + rx_buffer->page_offset;

	prefetch(va);

#if L1_CACHE_BYTES < 128

	prefetch(va + L1_CACHE_BYTES);
@@ -1362,7 +1363,7 @@ static struct sk_buff *iavf_build_skb(struct iavf_ring *rx_ring, 
				      struct iavf_rx_buffer *rx_buffer,

				      unsigned int size)

{

	void *va = page_address(rx_buffer->page) + rx_buffer->page_offset;

	void *va;

#if (PAGE_SIZE < 8192)

	unsigned int truesize = iavf_rx_pg_size(rx_ring) / 2;

#else
@@ -1374,6 +1375,7 @@ static struct sk_buff *iavf_build_skb(struct iavf_ring *rx_ring, 
	if (!rx_buffer)

		return NULL;

	/* prefetch first cache line of first page */

	va = page_address(rx_buffer->page) + rx_buffer->page_offset;

	prefetch(va);

#if L1_CACHE_BYTES < 128

	prefetch(va + L1_CACHE_BYTES);