Patch "net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-microchip-sparx5-fix-potential-null-ptr-deref-in.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fb585ec0dc42470d32b1179cf5e16ca1ad28909d
Author: Shang XiaoJing <shangxiaojing@xxxxxxxxxx>
Date:   Mon Nov 14 21:38:53 2022 +0800

    net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start()
    
    [ Upstream commit 639f5d006e36bb303f525d9479448c412b720c39 ]
    
    sparx_stats_init() calls create_singlethread_workqueue() and not
    checked the ret value, which may return NULL. And a null-ptr-deref may
    happen:
    
    sparx_stats_init()
        create_singlethread_workqueue() # failed, sparx5->stats_queue is NULL
        queue_delayed_work()
            queue_delayed_work_on()
                __queue_delayed_work()  # warning here, but continue
                    __queue_work()      # access wq->flags, null-ptr-deref
    
    Check the ret value and return -ENOMEM if it is NULL. So as
    sparx5_start().
    
    Fixes: af4b11022e2d ("net: sparx5: add ethtool configuration and statistics support")
    Fixes: b37a1bae742f ("net: sparx5: add mactable support")
    Signed-off-by: Shang XiaoJing <shangxiaojing@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c
index 10b866e9f726..060274caa4d0 100644
--- a/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c
+++ b/drivers/net/ethernet/microchip/sparx5/sparx5_ethtool.c
@@ -1219,6 +1219,9 @@ int sparx_stats_init(struct sparx5 *sparx5)
 	snprintf(queue_name, sizeof(queue_name), "%s-stats",
 		 dev_name(sparx5->dev));
 	sparx5->stats_queue = create_singlethread_workqueue(queue_name);
+	if (!sparx5->stats_queue)
+		return -ENOMEM;
+
 	INIT_DELAYED_WORK(&sparx5->stats_work, sparx5_check_stats_work);
 	queue_delayed_work(sparx5->stats_queue, &sparx5->stats_work,
 			   SPX5_STATS_CHECK_DELAY);
diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
index 5030dfca3879..435ac224e38e 100644
--- a/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
+++ b/drivers/net/ethernet/microchip/sparx5/sparx5_main.c
@@ -629,6 +629,9 @@ static int sparx5_start(struct sparx5 *sparx5)
 	snprintf(queue_name, sizeof(queue_name), "%s-mact",
 		 dev_name(sparx5->dev));
 	sparx5->mact_queue = create_singlethread_workqueue(queue_name);
+	if (!sparx5->mact_queue)
+		return -ENOMEM;
+
 	INIT_DELAYED_WORK(&sparx5->mact_work, sparx5_mact_pull_work);
 	queue_delayed_work(sparx5->mact_queue, &sparx5->mact_work,
 			   SPX5_MACT_PULL_DELAY);