net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()

[ Upstream commit 587acad41f1bc48e16f42bb2aca63bf323380be8 ]

Coverity reports a possible NULL dereferencing problem:

in smc_vlan_by_tcpsk():
6. returned_null: netdev_lower_get_next returns NULL (checked 29 out of 30 times).
7. var_assigned: Assigning: ndev = NULL return value from netdev_lower_get_next.
1623                ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
CID 1468509 (#1 of 1): Dereference null return value (NULL_RETURNS)
8. dereference: Dereferencing a pointer that might be NULL ndev when calling is_vlan_dev.
1624                if (is_vlan_dev(ndev)) {

Remove the manual implementation and use netdev_walk_all_lower_dev() to
iterate over the lower devices. While on it remove an obsolete function
parameter comment.

Fixes: cb9d43f67754 ("net/smc: determine vlan_id of stacked net_device")
Suggested-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index d672c0f0e247f6a2c5e3a6099a91b486052a580f..508a14fc4f5871160651df1588ca308003ac78c6 100644 (file)
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1596,14 +1596,26 @@ static void smc_link_down_work(struct work_struct *work)
        mutex_unlock(&lgr->llc_conf_mutex);
 }
 
-/* Determine vlan of internal TCP socket.
- * @vlan_id: address to store the determined vlan id into
- */
+static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev,
+                                 struct netdev_nested_priv *priv)
+{
+       unsigned short *vlan_id = (unsigned short *)priv->data;
+
+       if (is_vlan_dev(lower_dev)) {
+               *vlan_id = vlan_dev_vlan_id(lower_dev);
+               return 1;
+       }
+
+       return 0;
+}
+
+/* Determine vlan of internal TCP socket. */
 int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
 {
        struct dst_entry *dst = sk_dst_get(clcsock->sk);
+       struct netdev_nested_priv priv;
        struct net_device *ndev;
-       int i, nest_lvl, rc = 0;
+       int rc = 0;
 
        ini->vlan_id = 0;
        if (!dst) {
@@ -1621,20 +1633,9 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
                goto out_rel;
        }
 
+       priv.data = (void *)&ini->vlan_id;
        rtnl_lock();
-       nest_lvl = ndev->lower_level;
-       for (i = 0; i < nest_lvl; i++) {
-               struct list_head *lower = &ndev->adj_list.lower;
-
-               if (list_empty(lower))
-                       break;
-               lower = lower->next;
-               ndev = (struct net_device *)netdev_lower_get_next(ndev, &lower);
-               if (is_vlan_dev(ndev)) {
-                       ini->vlan_id = vlan_dev_vlan_id(ndev);
-                       break;
-               }
-       }
+       netdev_walk_all_lower_dev(ndev, smc_vlan_by_tcpsk_walk, &priv);
        rtnl_unlock();
 
 out_rel: