| Message ID | 20191126233619.235892-1-jeroendb@google.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] gve: Fix the queue page list allocated pages count | expand |
From: Jeroen de Borst <jeroendb@google.com> Date: Tue, 26 Nov 2019 15:36:19 -0800 > In gve_alloc_queue_page_list(), when a page allocation fails, > qpl->num_entries will be wrong. In this case priv->num_registered_pages > can underflow in gve_free_queue_page_list(), causing subsequent calls > to gve_alloc_queue_page_list() to fail. > > Fixes: f5cedc84a30d ("gve: Add transmit and receive support") > Signed-off-by: Jeroen de Borst <jeroendb@google.com> > Reviewed-by: Catherine Sullivan <csully@google.com> Applied and queued up for -stable.
diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c index aca95f64bde8..9b7a8db9860f 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -544,7 +544,7 @@ static int gve_alloc_queue_page_list(struct gve_priv *priv, u32 id, } qpl->id = id; - qpl->num_entries = pages; + qpl->num_entries = 0; qpl->pages = kvzalloc(pages * sizeof(*qpl->pages), GFP_KERNEL); /* caller handles clean up */ if (!qpl->pages) @@ -562,6 +562,7 @@ static int gve_alloc_queue_page_list(struct gve_priv *priv, u32 id, /* caller handles clean up */ if (err) return -ENOMEM; + qpl->num_entries++; } priv->num_registered_pages += pages;
In gve_alloc_queue_page_list(), when a page allocation fails, qpl->num_entries will be wrong. In this case priv->num_registered_pages can underflow in gve_free_queue_page_list(), causing subsequent calls to gve_alloc_queue_page_list() to fail. Fixes: f5cedc84a30d ("gve: Add transmit and receive support") Signed-off-by: Jeroen de Borst <jeroendb@google.com> Reviewed-by: Catherine Sullivan <csully@google.com> --- drivers/net/ethernet/google/gve/gve_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)