In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned
to the skb local variable. This may be an ERR_PTR.
A little later the following is executed, which seems to be a
possible dereference of an ERR_PTR.
total_bytes += skb->len;
Avoid this problem by continuing the loop in which all of the
above occurs once the handling of the NULL case completes.
This proposed fix is speculative - I do not have deep knowledge of this
driver. And I am concerned about the effect of skipping the following
logic:
igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
cleaned_count++;
Flagged by Smatch as:
.../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR'
Compile tested only.
Fixes: 26575105d6ed ("igc: Add initial XDP support")
Signed-off-by: Simon Horman <horms@xxxxxxxxxx>
---
drivers/net/ethernet/intel/igc/igc_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 88145c30c919..b58c8a674bd1 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -2586,6 +2586,7 @@ static int igc_clean_rx_irq(struct igc_q_vector *q_vector, const int budget)
total_packets++;
total_bytes += size;
+ continue;
} else if (skb)
igc_add_rx_frag(rx_ring, rx_buffer, skb, size);
else if (ring_uses_build_skb(rx_ring))
