| Message ID | d8bd90b3-913e-bd8d-6c4e-8409ecaf9c1a@solarflare.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] sfc: pass valid pointers from efx_enqueue_unwind | expand |
On 2017-12-07 12:18 PM, Bert Kenward wrote: > The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers > cannot be NULL. Add a paranoid warning to check this condition and fix > the one case where they were NULL. > > efx_enqueue_unwind() is called very rarely, during error handling. > Without this fix it would fail with a NULL pointer dereference in > efx_dequeue_buffer, with efx_enqueue_skb in the call stack. > > Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2") > Reported-by: Jarod Wilson <jarod@redhat.com> > Signed-off-by: Bert Kenward <bkenward@solarflare.com> I didn't have the warn, but the rest is identical to what I did locally to get around this when I was hitting it. Tested-by: Jarod Wilson <jarod@redhat.com> Acked-by: Jarod Wilson <jarod@redhat.com>
From: Bert Kenward <bkenward@solarflare.com> Date: Thu, 7 Dec 2017 17:18:58 +0000 > The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers > cannot be NULL. Add a paranoid warning to check this condition and fix > the one case where they were NULL. > > efx_enqueue_unwind() is called very rarely, during error handling. > Without this fix it would fail with a NULL pointer dereference in > efx_dequeue_buffer, with efx_enqueue_skb in the call stack. > > Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2") > Reported-by: Jarod Wilson <jarod@redhat.com> > Signed-off-by: Bert Kenward <bkenward@solarflare.com> Applied and queued up for -stable, thanks.
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c index 0ea7e16f2e6e..9937a2450e57 100644 --- a/drivers/net/ethernet/sfc/tx.c +++ b/drivers/net/ethernet/sfc/tx.c @@ -77,6 +77,7 @@ static void efx_dequeue_buffer(struct efx_tx_queue *tx_queue, } if (buffer->flags & EFX_TX_BUF_SKB) { + EFX_WARN_ON_PARANOID(!pkts_compl || !bytes_compl); (*pkts_compl)++; (*bytes_compl) += buffer->skb->len; dev_consume_skb_any((struct sk_buff *)buffer->skb); @@ -426,12 +427,14 @@ static int efx_tx_map_data(struct efx_tx_queue *tx_queue, struct sk_buff *skb, static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue) { struct efx_tx_buffer *buffer; + unsigned int bytes_compl = 0; + unsigned int pkts_compl = 0; /* Work backwards until we hit the original insert pointer value */ while (tx_queue->insert_count != tx_queue->write_count) { --tx_queue->insert_count; buffer = __efx_tx_queue_get_insert_buffer(tx_queue); - efx_dequeue_buffer(tx_queue, buffer, NULL, NULL); + efx_dequeue_buffer(tx_queue, buffer, &pkts_compl, &bytes_compl); } }
The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers cannot be NULL. Add a paranoid warning to check this condition and fix the one case where they were NULL. efx_enqueue_unwind() is called very rarely, during error handling. Without this fix it would fail with a NULL pointer dereference in efx_dequeue_buffer, with efx_enqueue_skb in the call stack. Fixes: e9117e5099ea ("sfc: Firmware-Assisted TSO version 2") Reported-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Bert Kenward <bkenward@solarflare.com> --- drivers/net/ethernet/sfc/tx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)