On 03/12/2018 10:32 PM, Josh Elsasser wrote:
init_dummy_netdev() leaves its netdev_ops pointer zeroed. This leads
to a NULL pointer dereference when sk_busy_loop fires against an iwlwifi
wireless adapter and checks napi->dev->netdev_ops->ndo_busy_poll.

Avoid this by ensuring napi->dev->netdev_ops is valid before following
the pointer, avoiding the following panic when busy polling on a dummy

Fixes: 060212928670 ("net: add low latency socket poll")
Fixes: ce6aea93f751 ("net: network drivers no longer need to implement 
ndo_busy_poll()") - 4.9.y
Signed-off-by: Josh Elsasser <jelsas...@appneta.com>
  net/core/dev.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 8898618bf341..1f50c131ed15 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5042,7 +5042,10 @@ bool sk_busy_loop(struct sock *sk, int nonblock)
                goto out;
/* Note: ndo_busy_poll method is optional in linux-4.5 */
-       busy_poll = napi->dev->netdev_ops->ndo_busy_poll;
+       if (napi->dev->netdev_ops)
+               busy_poll = napi->dev->netdev_ops->ndo_busy_poll;
+       else
+               busy_poll = NULL;
do {
                rc = 0;

We could instead setup a non NULL netdev_ops pointer on these 'dummy' devices to not add a check in fast path, but I presume we do not really care since this fix is for old kernels, and considering how long it took to discover this bug.

Reviewed-by: Eric Dumazet <eduma...@google.com>

Reply via email to