From: Jakub Kicinski <kuba@kernel•org>
To: Fan Gong <gongfan1@huawei•com>
Cc: Zhu Yikai <zhuyikai1@h-partners•com>, <netdev@vger•kernel.org>,
"David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Paolo Abeni <pabeni@redhat•com>, Simon Horman <horms@kernel•org>,
Andrew Lunn <andrew+netdev@lunn•ch>,
Markus Elfring <Markus.Elfring@web•de>,
Pavan Chebbi <pavan.chebbi@broadcom•com>,
ALOK TIWARI <alok.a.tiwari@oracle•com>,
<linux-kernel@vger•kernel.org>, <linux-doc@vger•kernel.org>,
luosifu <luosifu@huawei•com>, Xin Guo <guoxin09@huawei•com>,
Shen Chenyang <shenchenyang1@hisilicon•com>,
Zhou Shuai <zhoushuai28@huawei•com>, Wu Like <wulike1@huawei•com>,
Shi Jing <shijing34@huawei•com>,
Luo Yang <luoyang82@h-partners•com>
Subject: Re: [PATCH net-next v08 8/9] hinic3: Add mac filter ops
Date: Mon, 5 Jan 2026 17:41:40 -0800 [thread overview]
Message-ID: <20260105174140.1c2b9021@kernel.org> (raw)
In-Reply-To: <8555005e3263a6de0d43be148f1d20ecab145eb0.1767495881.git.zhuyikai1@h-partners.com>
AI code review points out:
> +static int hinic3_mac_filter_sync_hw(struct net_device *netdev,
> + struct list_head *del_list,
> + struct list_head *add_list,
> + int *add_count)
> +{
> + struct hinic3_mac_filter *ftmp;
> + struct hinic3_mac_filter *f;
> + int err;
> +
> + if (!list_empty(del_list)) {
> + list_for_each_entry_safe(f, ftmp, del_list, list) {
> + /* ignore errors when deleting mac */
> + hinic3_filter_addr_unsync(netdev, f->addr);
> + list_del(&f->list);
> + kfree(f);
> + }
> + }
> +
> + if (!list_empty(add_list)) {
> + list_for_each_entry_safe(f, ftmp, add_list, list) {
> + if (f->state != HINIC3_MAC_HW_SYNCING)
> + continue;
> +
> + err = hinic3_filter_addr_sync(netdev, f->addr);
> + if (err) {
> + netdev_err(netdev, "Failed to add mac\n");
> + return err;
> + }
> +
> + f->state = HINIC3_MAC_HW_SYNCED;
> + (*add_count)++;
> + }
> + }
> +
> + return 0;
> +}
[ ... ]
> + err = hinic3_mac_filter_sync_hw(netdev, &tmp_del_list,
> + &tmp_add_list, &add_count);
> + if (err) {
> + /* there were errors, delete all mac in hw */
> + hinic3_undo_add_filter_entries(mac_filter_list, &tmp_add_list);
[ ... ]
> + hinic3_mac_filter_sync_hw(netdev, &tmp_del_list,
> + &tmp_add_list, NULL);
^^^^
Can this NULL pointer dereference add_count in hinic3_mac_filter_sync_hw()?
When hinic3_filter_addr_sync() fails in the first call to
hinic3_mac_filter_sync_hw(), the function returns early with an error.
At that point tmp_add_list may still contain entries with state
HINIC3_MAC_HW_SYNCING (entries that were not yet processed).
The second call passes NULL for add_count. If tmp_add_list is not empty
and has entries with HINIC3_MAC_HW_SYNCING state, the code will execute
(*add_count)++ with add_count being NULL.
next prev parent reply other threads:[~2026-01-06 1:41 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-05 3:13 [PATCH net-next v08 0/9] net: hinic3: PF initialization Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 1/9] hinic3: Add PF framework Fan Gong
2026-01-06 1:39 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 2/9] hinic3: Add PF management interfaces Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 3/9] hinic3: Add .ndo_tx_timeout and .ndo_get_stats64 Fan Gong
2026-01-06 1:39 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 4/9] hinic3: Add .ndo_set_features and .ndo_fix_features Fan Gong
2026-01-06 1:40 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 5/9] hinic3: Add .ndo_features_check Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 6/9] hinic3: Add .ndo_vlan_rx_add/kill_vid and .ndo_validate_addr Fan Gong
2026-01-05 3:13 ` [PATCH net-next v08 7/9] hinic3: Add adaptive IRQ coalescing with DIM Fan Gong
2026-01-06 1:40 ` Jakub Kicinski
2026-01-05 3:13 ` [PATCH net-next v08 8/9] hinic3: Add mac filter ops Fan Gong
2026-01-06 1:41 ` Jakub Kicinski [this message]
2026-01-05 3:13 ` [PATCH net-next v08 9/9] hinic3: Add HW event handler Fan Gong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260105174140.1c2b9021@kernel.org \
--to=kuba@kernel$(echo .)org \
--cc=Markus.Elfring@web$(echo .)de \
--cc=alok.a.tiwari@oracle$(echo .)com \
--cc=andrew+netdev@lunn$(echo .)ch \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=gongfan1@huawei$(echo .)com \
--cc=guoxin09@huawei$(echo .)com \
--cc=horms@kernel$(echo .)org \
--cc=linux-doc@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=luosifu@huawei$(echo .)com \
--cc=luoyang82@h-partners$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pavan.chebbi@broadcom$(echo .)com \
--cc=shenchenyang1@hisilicon$(echo .)com \
--cc=shijing34@huawei$(echo .)com \
--cc=wulike1@huawei$(echo .)com \
--cc=zhoushuai28@huawei$(echo .)com \
--cc=zhuyikai1@h-partners$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox