> -----Original Message-----
> From: Intel-wired-lan <[email protected]> On Behalf Of
> Pavan Kumar Linga
> Sent: Friday, April 11, 2025 9:01 AM
> To: [email protected]
> Cc: [email protected]; Linga, Pavan Kumar
> <[email protected]>; Chittim, Madhu
> <[email protected]>
> Subject: [Intel-wired-lan] [PATCH iwl-net] idpf: fix null-ptr-deref in
> idpf_features_check
>
> idpf_features_check is used to validate the TX packet. skb header length is
> compared with the hardware supported value received from the device
> control plane. The value is stored in the adapter structure and to access it,
> vport pointer is used. During reset all the vports are released and the vport
> pointer that the netdev private structure points to is NULL.
>
> To avoid null-ptr-deref, store the max header length value in netdev private
> structure. This also helps to cache the value and avoid accessing adapter
> pointer in hot path.
>
> BUG: kernel NULL pointer dereference, address: 0000000000000068 ...
> RIP: 0010:idpf_features_check+0x6d/0xe0 [idpf] Call Trace:
> <TASK>
> ? __die+0x23/0x70
> ? page_fault_oops+0x154/0x520
> ? exc_page_fault+0x76/0x190
> ? asm_exc_page_fault+0x26/0x30
> ? idpf_features_check+0x6d/0xe0 [idpf]
> netif_skb_features+0x88/0x310
> validate_xmit_skb+0x2a/0x2b0
> validate_xmit_skb_list+0x4c/0x70
> sch_direct_xmit+0x19d/0x3a0
> __dev_queue_xmit+0xb74/0xe70
> ...
>
> Fixes: a251eee62133 ("idpf: add SRIOV support and other ndo_ops")
> Reviewed-by: Madhu Chititm <[email protected]>
> Signed-off-by: Pavan Kumar Linga <[email protected]>
> ---
> 2.43.0
Tested-by: Samuel Salin <[email protected]>
