Commit 587acad4 authored by Karsten Graul's avatar Karsten Graul Committed by Jakub Kicinski
Browse files

net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk() 



Coverity reports a possible NULL dereferencing problem:

in smc_vlan_by_tcpsk():
6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times).
7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next.
1623                ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
CID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS)
8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev.
1624                if (is_vlan_dev(ndev)) {

Remove the manual implementation and use netdev_walk_all_lower_dev() to
iterate over the lower devices. While on it remove an obsolete function
parameter comment.

Fixes: cb9d43f6 ("net/smc: determine vlan_id of stacked net_device")
Suggested-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 06e5ba71

net/smc/smc_core.c

+18 −17
Original line number Diff line number Diff line
@@ -1672,14 +1672,26 @@ static void smc_link_down_work(struct work_struct *work) 
	mutex_unlock(&lgr->llc_conf_mutex);

}



/* Determine vlan of internal TCP socket.

 * @vlan_id: address to store the determined vlan id into

 */

static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,

				  struct netdev_nested_priv *priv)

{

	unsigned short *vlan_id = (unsigned short *)priv->data;



	if (is_vlan_dev(lower_dev)) {

		*vlan_id = vlan_dev_vlan_id(lower_dev);

		return 1;

	}



	return 0;

}



/* Determine vlan of internal TCP socket. */

int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)

{

	struct dst_entry *dst = sk_dst_get(clcsock->sk);

	struct netdev_nested_priv priv;

	struct net_device *ndev;

	int i, nest_lvl, rc = 0;

	int rc = 0;



	ini->vlan_id = 0;

	if (!dst) {
@@ -1697,20 +1709,9 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini) 
		goto out_rel;

	}



	priv.data = (void *)&ini->vlan_id;

	rtnl_lock();

	nest_lvl = ndev->lower_level;

	for (i = 0; i < nest_lvl; i++) {

		struct list_head *lower = &ndev->adj_list.lower;



		if (list_empty(lower))

			break;

		lower = lower->next;

		ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);

		if (is_vlan_dev(ndev)) {

			ini->vlan_id = vlan_dev_vlan_id(ndev);

			break;

		}

	}

	netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv);

	rtnl_unlock();



out_rel: