* [PATCH net] sfc: pass valid pointers from efx_enqueue_unwind
@ 2017-12-07 17:18 Bert Kenward
2017-12-08 15:37 ` Jarod Wilson
2017-12-08 18:26 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Bert Kenward @ 2017-12-07 17:18 UTC (permalink / raw)
To: Dave Miller; +Cc: netdev, linux-net-drivers, Jarod Wilson
The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers
cannot be NULL. Add a paranoid warning to check this condition and fix
the one case where they were NULL.
efx_enqueue_unwind() is called very rarely, during error handling.
Without this fix it would fail with a NULL pointer dereference in
efx_dequeue_buffer, with efx_enqueue_skb in the call stack.
Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2")
Reported-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Bert Kenward <bkenward@solarflare.com>
---
drivers/net/ethernet/sfc/tx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index 0ea7e16f2e6e..9937a2450e57 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -77,6 +77,7 @@ static void efx_dequeue_buffer(struct efx_tx_queue *tx_queue,
}
if (buffer->flags & EFX_TX_BUF_SKB) {
+ EFX_WARN_ON_PARANOID(!pkts_compl || !bytes_compl);
(*pkts_compl)++;
(*bytes_compl) += buffer->skb->len;
dev_consume_skb_any((struct sk_buff *)buffer->skb);
@@ -426,12 +427,14 @@ static int efx_tx_map_data(struct efx_tx_queue *tx_queue, struct sk_buff *skb,
static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)
{
struct efx_tx_buffer *buffer;
+ unsigned int bytes_compl = 0;
+ unsigned int pkts_compl = 0;
/* Work backwards until we hit the original insert pointer value */
while (tx_queue->insert_count != tx_queue->write_count) {
--tx_queue->insert_count;
buffer = __efx_tx_queue_get_insert_buffer(tx_queue);
- efx_dequeue_buffer(tx_queue, buffer, NULL, NULL);
+ efx_dequeue_buffer(tx_queue, buffer, &pkts_compl, &bytes_compl);
}
}
--
2.13.6
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] sfc: pass valid pointers from efx_enqueue_unwind
2017-12-07 17:18 [PATCH net] sfc: pass valid pointers from efx_enqueue_unwind Bert Kenward
@ 2017-12-08 15:37 ` Jarod Wilson
2017-12-08 18:26 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Jarod Wilson @ 2017-12-08 15:37 UTC (permalink / raw)
To: Bert Kenward, Dave Miller; +Cc: netdev, linux-net-drivers
On 2017-12-07 12:18 PM, Bert Kenward wrote:
> The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers
> cannot be NULL. Add a paranoid warning to check this condition and fix
> the one case where they were NULL.
>
> efx_enqueue_unwind() is called very rarely, during error handling.
> Without this fix it would fail with a NULL pointer dereference in
> efx_dequeue_buffer, with efx_enqueue_skb in the call stack.
>
> Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2")
> Reported-by: Jarod Wilson <jarod@redhat.com>
> Signed-off-by: Bert Kenward <bkenward@solarflare.com>
I didn't have the warn, but the rest is identical to what I did locally
to get around this when I was hitting it.
Tested-by: Jarod Wilson <jarod@redhat.com>
Acked-by: Jarod Wilson <jarod@redhat.com>
--
Jarod Wilson
jarod@redhat.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] sfc: pass valid pointers from efx_enqueue_unwind
2017-12-07 17:18 [PATCH net] sfc: pass valid pointers from efx_enqueue_unwind Bert Kenward
2017-12-08 15:37 ` Jarod Wilson
@ 2017-12-08 18:26 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-12-08 18:26 UTC (permalink / raw)
To: bkenward; +Cc: netdev, linux-net-drivers, jarod
From: Bert Kenward <bkenward@solarflare.com>
Date: Thu, 7 Dec 2017 17:18:58 +0000
> The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers
> cannot be NULL. Add a paranoid warning to check this condition and fix
> the one case where they were NULL.
>
> efx_enqueue_unwind() is called very rarely, during error handling.
> Without this fix it would fail with a NULL pointer dereference in
> efx_dequeue_buffer, with efx_enqueue_skb in the call stack.
>
> Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2")
> Reported-by: Jarod Wilson <jarod@redhat.com>
> Signed-off-by: Bert Kenward <bkenward@solarflare.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-12-08 18:26 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-12-07 17:18 [PATCH net] sfc: pass valid pointers from efx_enqueue_unwind Bert Kenward
2017-12-08 15:37 ` Jarod Wilson
2017-12-08 18:26 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.