On Fri, Apr 11, 2025 at 09:00:35AM -0700, Pavan Kumar Linga wrote:
> idpf_features_check is used to validate the TX packet. skb header
> length is compared with the hardware supported value received from
> the device control plane. The value is stored in the adapter structure
> and to access it, vport pointer is used. During reset all the vports
> are released and the vport pointer that the netdev private structure
> points to is NULL.
>
> To avoid null-ptr-deref, store the max header length value in netdev
> private structure. This also helps to cache the value and avoid
> accessing adapter pointer in hot path.
>
> BUG: kernel NULL pointer dereference, address: 0000000000000068
> ...
> RIP: 0010:idpf_features_check+0x6d/0xe0 [idpf]
> Call Trace:
> <TASK>
> ? __die+0x23/0x70
> ? page_fault_oops+0x154/0x520
> ? exc_page_fault+0x76/0x190
> ? asm_exc_page_fault+0x26/0x30
> ? idpf_features_check+0x6d/0xe0 [idpf]
> netif_skb_features+0x88/0x310
> validate_xmit_skb+0x2a/0x2b0
> validate_xmit_skb_list+0x4c/0x70
> sch_direct_xmit+0x19d/0x3a0
> __dev_queue_xmit+0xb74/0xe70
> ...
>
> Fixes: a251eee62133 ("idpf: add SRIOV support and other ndo_ops")
> Reviewed-by: Madhu Chititm <[email protected]>
> Signed-off-by: Pavan Kumar Linga <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
