Re: [PATCH net v2] net: core: failover: fix NULL pointer dereference in failover_slave_register()
From: Dan Carpenter <hidden>
Date: 2026-02-26 08:02:10
Also in:
kernel-janitors, lkml
On Thu, Feb 26, 2026 at 12:57:37PM +0500, Zeeshan Ahmad wrote:
quoted hunk ↗ jump to hunk
Smatch warns that 'fops' is dereferenced at line 69 without a NULL check. While other callbacks in this function properly check 'fops', the rx_handler registration does not. If failover_get_bymac() returns a valid failover_dev but a NULL fops, the kernel will encounter a NULL pointer dereference when registering the rx_handler. Following the pattern of other failover callers, add a WARN_ON_ONCE() to catch this misconfiguration. Abort the registration if fops is missing to prevent an inconsistent state where a slave is logically linked to a master but lacks a functional data path hook. Fixes: 30c8bd5aa8b2 ("net: Introduce generic failover module") Signed-off-by: Zeeshan Ahmad <redacted> --- v2: - Target 'net' tree as this is a bug fix. - Change logic from an early return (v1) to WARN_ON_ONCE() and abort registration to prevent inconsistent state, as discussed with Simon Horman. - Update commit message with detailed impact analysis. net/core/failover.c | 3 +++ 1 file changed, 3 insertions(+)diff --git a/net/core/failover.c b/net/core/failover.c index 2a140b3ea669..1702bb1feca1 100644 --- a/net/core/failover.c +++ b/net/core/failover.c@@ -63,6 +63,9 @@ static int failover_slave_register(struct net_device *slave_dev) fops->slave_pre_register(slave_dev, failover_dev))
^^^^^^^^^^^^^^^^^^^^^^^^^
goto done; + if (WARN_ON_ONCE(!fops)) + goto done;
Move the NULL check in front of the fops->slave_pre_register() stuff and delete the other later NULL checks. regards, dan carpenter