Skip to content

Commit 96c1559

Browse files
Aleksandr Mishinkuba-moo
authored andcommitted
net: phy: micrel: Fix potential null pointer dereference
In lan8814_get_sig_rx() and lan8814_get_sig_tx() ptp_parse_header() may return NULL as ptp_header due to abnormal packet type or corrupted packet. Fix this bug by adding ptp_header check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ece1950 ("net: phy: micrel: 1588 support for LAN8814 phy") Signed-off-by: Aleksandr Mishin <[email protected]> Reviewed-by: Andrew Lunn <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent 365af7a commit 96c1559

File tree

1 file changed

+16
-5
lines changed

1 file changed

+16
-5
lines changed

drivers/net/phy/micrel.c

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2537,7 +2537,7 @@ static void lan8814_txtstamp(struct mii_timestamper *mii_ts,
25372537
}
25382538
}
25392539

2540-
static void lan8814_get_sig_rx(struct sk_buff *skb, u16 *sig)
2540+
static bool lan8814_get_sig_rx(struct sk_buff *skb, u16 *sig)
25412541
{
25422542
struct ptp_header *ptp_header;
25432543
u32 type;
@@ -2547,7 +2547,11 @@ static void lan8814_get_sig_rx(struct sk_buff *skb, u16 *sig)
25472547
ptp_header = ptp_parse_header(skb, type);
25482548
skb_pull_inline(skb, ETH_HLEN);
25492549

2550+
if (!ptp_header)
2551+
return false;
2552+
25502553
*sig = (__force u16)(ntohs(ptp_header->sequence_id));
2554+
return true;
25512555
}
25522556

25532557
static bool lan8814_match_rx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2559,7 +2563,8 @@ static bool lan8814_match_rx_skb(struct kszphy_ptp_priv *ptp_priv,
25592563
bool ret = false;
25602564
u16 skb_sig;
25612565

2562-
lan8814_get_sig_rx(skb, &skb_sig);
2566+
if (!lan8814_get_sig_rx(skb, &skb_sig))
2567+
return ret;
25632568

25642569
/* Iterate over all RX timestamps and match it with the received skbs */
25652570
spin_lock_irqsave(&ptp_priv->rx_ts_lock, flags);
@@ -2834,15 +2839,19 @@ static int lan8814_ptpci_adjfine(struct ptp_clock_info *ptpci, long scaled_ppm)
28342839
return 0;
28352840
}
28362841

2837-
static void lan8814_get_sig_tx(struct sk_buff *skb, u16 *sig)
2842+
static bool lan8814_get_sig_tx(struct sk_buff *skb, u16 *sig)
28382843
{
28392844
struct ptp_header *ptp_header;
28402845
u32 type;
28412846

28422847
type = ptp_classify_raw(skb);
28432848
ptp_header = ptp_parse_header(skb, type);
28442849

2850+
if (!ptp_header)
2851+
return false;
2852+
28452853
*sig = (__force u16)(ntohs(ptp_header->sequence_id));
2854+
return true;
28462855
}
28472856

28482857
static void lan8814_match_tx_skb(struct kszphy_ptp_priv *ptp_priv,
@@ -2856,7 +2865,8 @@ static void lan8814_match_tx_skb(struct kszphy_ptp_priv *ptp_priv,
28562865

28572866
spin_lock_irqsave(&ptp_priv->tx_queue.lock, flags);
28582867
skb_queue_walk_safe(&ptp_priv->tx_queue, skb, skb_tmp) {
2859-
lan8814_get_sig_tx(skb, &skb_sig);
2868+
if (!lan8814_get_sig_tx(skb, &skb_sig))
2869+
continue;
28602870

28612871
if (memcmp(&skb_sig, &seq_id, sizeof(seq_id)))
28622872
continue;
@@ -2910,7 +2920,8 @@ static bool lan8814_match_skb(struct kszphy_ptp_priv *ptp_priv,
29102920

29112921
spin_lock_irqsave(&ptp_priv->rx_queue.lock, flags);
29122922
skb_queue_walk_safe(&ptp_priv->rx_queue, skb, skb_tmp) {
2913-
lan8814_get_sig_rx(skb, &skb_sig);
2923+
if (!lan8814_get_sig_rx(skb, &skb_sig))
2924+
continue;
29142925

29152926
if (memcmp(&skb_sig, &rx_ts->seq_id, sizeof(rx_ts->seq_id)))
29162927
continue;

0 commit comments

Comments
 (0)