Patchwork be2net: bug fix on returning an invalid nic descriptor

login
register
mail settings
Submitter Wei Yang
Date May 23, 2013, 1:58 a.m.
Message ID <1369274302-8118-1-git-send-email-weiyang@linux.vnet.ibm.com>
Download mbox | patch
Permalink /patch/245795/
State Accepted
Delegated to: David Miller
Headers show

Comments

Wei Yang - May 23, 2013, 1:58 a.m.
In function be_get_nic_desc(), it will go through the descriptor array
returned from f/w. By comparing the desc_type field, it determines whether
there is a nic descriptor in the array or not. In the case of no nic
descriptor, this function should return NULL.

The code may return an invalide descriptor, when there is no nic descriptor
in the array and the desc_count is less than MAX_RESOURCE_DESC. In this case,
even there is no nic descriptor, it will still return the lase descriptor
since the i doesn't equal to MAX_RESOURCE_DESC.

This patch fix this issue by returning the descriptor when find it and return
NULL for other cases.

Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
Reviewed-by: Gavin Shan <shangw@linux.vnet.ibm.com>
Reviewed-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
---
 drivers/net/ethernet/emulex/benet/be_cmds.c |   13 ++++---------
 1 files changed, 4 insertions(+), 9 deletions(-)
Sathya Perla - May 23, 2013, 4:32 a.m.
> -----Original Message-----
> From: Wei Yang [mailto:weiyang@linux.vnet.ibm.com]
> 
> In function be_get_nic_desc(), it will go through the descriptor array
> returned from f/w. By comparing the desc_type field, it determines whether
> there is a nic descriptor in the array or not. In the case of no nic descriptor,
> this function should return NULL.
> 
> The code may return an invalide descriptor, when there is no nic descriptor in
> the array and the desc_count is less than MAX_RESOURCE_DESC. In this
> case, even there is no nic descriptor, it will still return the lase descriptor
> since the i doesn't equal to MAX_RESOURCE_DESC.
> 
> This patch fix this issue by returning the descriptor when find it and return
> NULL for other cases.
> 
> Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
> Reviewed-by: Gavin Shan <shangw@linux.vnet.ibm.com>
> Reviewed-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>

Acked-by: Sathya Perla <sathya.perla@emulex.com>

Thanks for the fix.
-Sathya
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller - May 24, 2013, 1:57 a.m.
From: Wei Yang <weiyang@linux.vnet.ibm.com>
Date: Thu, 23 May 2013 09:58:22 +0800

> In function be_get_nic_desc(), it will go through the descriptor array
> returned from f/w. By comparing the desc_type field, it determines whether
> there is a nic descriptor in the array or not. In the case of no nic
> descriptor, this function should return NULL.
> 
> The code may return an invalide descriptor, when there is no nic descriptor
> in the array and the desc_count is less than MAX_RESOURCE_DESC. In this case,
> even there is no nic descriptor, it will still return the lase descriptor
> since the i doesn't equal to MAX_RESOURCE_DESC.
> 
> This patch fix this issue by returning the descriptor when find it and return
> NULL for other cases.
> 
> Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
> Reviewed-by: Gavin Shan <shangw@linux.vnet.ibm.com>
> Reviewed-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Wei Yang - May 24, 2013, 2:12 a.m.
On Thu, May 23, 2013 at 06:57:04PM -0700, David Miller wrote:
>From: Wei Yang <weiyang@linux.vnet.ibm.com>
>Date: Thu, 23 May 2013 09:58:22 +0800
>
>> In function be_get_nic_desc(), it will go through the descriptor array
>> returned from f/w. By comparing the desc_type field, it determines whether
>> there is a nic descriptor in the array or not. In the case of no nic
>> descriptor, this function should return NULL.
>> 
>> The code may return an invalide descriptor, when there is no nic descriptor
>> in the array and the desc_count is less than MAX_RESOURCE_DESC. In this case,
>> even there is no nic descriptor, it will still return the lase descriptor
>> since the i doesn't equal to MAX_RESOURCE_DESC.
>> 
>> This patch fix this issue by returning the descriptor when find it and return
>> NULL for other cases.
>> 
>> Signed-off-by: Wei Yang <weiyang@linux.vnet.ibm.com>
>> Reviewed-by: Gavin Shan <shangw@linux.vnet.ibm.com>
>> Reviewed-by: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
>
>Applied.

Got it, Thanks~

Patch

diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index fd7b547..a236ecd 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -2976,22 +2976,17 @@  static struct be_nic_resource_desc *be_get_nic_desc(u8 *buf, u32 desc_count,
 	for (i = 0; i < desc_count; i++) {
 		desc->desc_len = desc->desc_len ? : RESOURCE_DESC_SIZE;
 		if (((void *)desc + desc->desc_len) >
-		    (void *)(buf + max_buf_size)) {
-			desc = NULL;
-			break;
-		}
+		    (void *)(buf + max_buf_size))
+			return NULL;
 
 		if (desc->desc_type == NIC_RESOURCE_DESC_TYPE_V0 ||
 		    desc->desc_type == NIC_RESOURCE_DESC_TYPE_V1)
-			break;
+			return desc;
 
 		desc = (void *)desc + desc->desc_len;
 	}
 
-	if (!desc || i == MAX_RESOURCE_DESC)
-		return NULL;
-
-	return desc;
+	return NULL;
 }
 
 /* Uses Mbox */