From: Jakub Kicinski <kuba@kernel•org>
To: Fan Gong <gongfan1@huawei•com>
Cc: Zhu Yikai <zhuyikai1@h-partners•com>, <netdev@vger•kernel.org>,
"David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Paolo Abeni <pabeni@redhat•com>, Simon Horman <horms@kernel•org>,
Andrew Lunn <andrew+netdev@lunn•ch>,
Markus Elfring <Markus.Elfring@web•de>,
Pavan Chebbi <pavan.chebbi@broadcom•com>,
ALOK TIWARI <alok.a.tiwari@oracle•com>,
<linux-kernel@vger•kernel.org>, <linux-doc@vger•kernel.org>,
luosifu <luosifu@huawei•com>, Xin Guo <guoxin09@huawei•com>,
Shen Chenyang <shenchenyang1@hisilicon•com>,
Zhou Shuai <zhoushuai28@huawei•com>, Wu Like <wulike1@huawei•com>,
Shi Jing <shijing34@huawei•com>,
Luo Yang <luoyang82@h-partners•com>
Subject: Re: [PATCH net-next v08 1/9] hinic3: Add PF framework
Date: Mon, 5 Jan 2026 17:39:16 -0800 [thread overview]
Message-ID: <20260105173916.4a0b29bc@kernel.org> (raw)
In-Reply-To: <c1644bd9246a2cb6c2bbac87747ef6dd224bb2ae.1767495881.git.zhuyikai1@h-partners.com>
AI code review points out the following.
Please address or add a relevant comment explaining why the code
is fine.
> diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_mbox.c b/drivers/net/ethernet/huawei/hinic3/hinic3_mbox.c
> index cf67e26acece..1cb0d88911a2 100644
> --- a/drivers/net/ethernet/huawei/hinic3/hinic3_mbox.c
> +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_mbox.c
> @@ -82,10 +82,19 @@ static struct hinic3_msg_desc *get_mbox_msg_desc(struct hinic3_mbox *mbox,
> enum mbox_msg_direction_type dir,
> u16 src_func_id)
> {
> + struct hinic3_hwdev *hwdev = mbox->hwdev;
> struct hinic3_msg_channel *msg_ch;
>
> - msg_ch = (src_func_id == MBOX_MGMT_FUNC_ID) ?
> - &mbox->mgmt_msg : mbox->func_msg;
> + if (src_func_id == MBOX_MGMT_FUNC_ID) {
> + msg_ch = &mbox->mgmt_msg;
> + } else if (HINIC3_IS_VF(hwdev)) {
> + /* message from pf */
> + msg_ch = mbox->func_msg;
> + if (src_func_id != hinic3_pf_id_of_vf(hwdev) || !msg_ch)
> + return NULL;
> + } else {
> + return NULL;
> + }
Can this return NULL for PF when src_func_id is not MBOX_MGMT_FUNC_ID?
Looking at hinic3_mbox_func_aeqe_handler(), the caller of get_mbox_msg_desc():
msg_desc = get_mbox_msg_desc(mbox, dir, src_func_id);
recv_mbox_handler(mbox, header, msg_desc);
The return value is passed directly to recv_mbox_handler() without a
NULL check. Inside recv_mbox_handler():
if (!mbox_segment_valid(mbox, msg_desc, mbox_header)) {
msg_desc->seq_id = MBOX_SEQ_ID_MAX_VAL;
And mbox_segment_valid() dereferences msg_desc unconditionally:
msg_desc->seq_id = seq_id;
If a PF receives a mailbox message from any source other than management
(for example, from a VF), get_mbox_msg_desc() returns NULL, and then
mbox_segment_valid() will dereference the NULL pointer causing a kernel
crash.
Should hinic3_mbox_func_aeqe_handler() check for NULL before calling
recv_mbox_handler()?
next prev parent reply other threads:[~2026-01-06 1:39 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-05 3:13 [PATCH net-next v08 0/9] net: hinic3: PF initialization Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 1/9] hinic3: Add PF framework Fan Gong
2026-01-06 1:39 ` Jakub Kicinski [this message]
2026-01-05 3:13 ` [PATCH net-next v08 2/9] hinic3: Add PF management interfaces Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 3/9] hinic3: Add .ndo_tx_timeout and .ndo_get_stats64 Fan Gong
2026-01-06 1:39 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 4/9] hinic3: Add .ndo_set_features and .ndo_fix_features Fan Gong
2026-01-06 1:40 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 5/9] hinic3: Add .ndo_features_check Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 6/9] hinic3: Add .ndo_vlan_rx_add/kill_vid and .ndo_validate_addr Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 7/9] hinic3: Add adaptive IRQ coalescing with DIM Fan Gong
2026-01-06 1:40 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 8/9] hinic3: Add mac filter ops Fan Gong
2026-01-06 1:41 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 9/9] hinic3: Add HW event handler Fan Gong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260105173916.4a0b29bc@kernel.org \
--to=kuba@kernel$(echo .)org \
--cc=Markus.Elfring@web$(echo .)de \
--cc=alok.a.tiwari@oracle$(echo .)com \
--cc=andrew+netdev@lunn$(echo .)ch \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=gongfan1@huawei$(echo .)com \
--cc=guoxin09@huawei$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=linux-doc@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=luosifu@huawei$(echo .)com \
--cc=luoyang82@h-partners$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pavan.chebbi@broadcom$(echo .)com \
--cc=shenchenyang1@hisilicon$(echo .)com \
--cc=shijing34@huawei$(echo .)com \
--cc=wulike1@huawei$(echo .)com \
--cc=zhoushuai28@huawei$(echo .)com \
--cc=zhuyikai1@h-partners$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox