projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| 74106e0a GKH |
1 | From foo@baz Mon Apr 15 09:15:08 CEST 2019 |
| 2 | From: Michael Chan <michael.chan@broadcom.com> | |
| 3 | Date: Mon, 8 Apr 2019 17:39:54 -0400 | |
| 4 | Subject: bnxt_en: Improve RX consumer index validity check. | |
| 5 | ||
| 6 | From: Michael Chan <michael.chan@broadcom.com> | |
| 7 | ||
| 8 | [ Upstream commit a1b0e4e684e9c300b9e759b46cb7a0147e61ddff ] | |
| 9 | ||
| 10 | There is logic to check that the RX/TPA consumer index is the expected | |
| 11 | index to work around a hardware problem. However, the potentially bad | |
| 12 | consumer index is first used to index into an array to reference an entry. | |
| 13 | This can potentially crash if the bad consumer index is beyond legal | |
| 14 | range. Improve the logic to use the consumer index for dereferencing | |
| 15 | after the validity check and log an error message. | |
| 16 | ||
| 17 | Fixes: fa7e28127a5a ("bnxt_en: Add workaround to detect bad opaque in rx completion (part 2)") | |
| 18 | Signed-off-by: Michael Chan <michael.chan@broadcom.com> | |
| 19 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
| 20 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 21 | --- | |
| 22 | drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++++-- | |
| 23 | 1 file changed, 6 insertions(+), 2 deletions(-) | |
| 24 | ||
| 25 | --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c | |
| 26 | +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | |
| 27 | @@ -959,6 +959,8 @@ static void bnxt_tpa_start(struct bnxt * | |
| 28 | tpa_info = &rxr->rx_tpa[agg_id]; | |
| 29 | ||
| 30 | if (unlikely(cons != rxr->rx_next_cons)) { | |
| 31 | + netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n", | |
| 32 | + cons, rxr->rx_next_cons); | |
| 33 | bnxt_sched_reset(bp, rxr); | |
| 34 | return; | |
| 35 | } | |
| 36 | @@ -1377,14 +1379,16 @@ static int bnxt_rx_pkt(struct bnxt *bp, | |
| 37 | } | |
| 38 | ||
| 39 | cons = rxcmp->rx_cmp_opaque; | |
| 40 | - rx_buf = &rxr->rx_buf_ring[cons]; | |
| 41 | - data = rx_buf->data; | |
| 42 | if (unlikely(cons != rxr->rx_next_cons)) { | |
| 43 | int rc1 = bnxt_discard_rx(bp, bnapi, raw_cons, rxcmp); | |
| 44 | ||
| 45 | + netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", | |
| 46 | + cons, rxr->rx_next_cons); | |
| 47 | bnxt_sched_reset(bp, rxr); | |
| 48 | return rc1; | |
| 49 | } | |
| 50 | + rx_buf = &rxr->rx_buf_ring[cons]; | |
| 51 | + data = rx_buf->data; | |
| 52 | prefetch(data); | |
| 53 | ||
| 54 | agg_bufs = (le32_to_cpu(rxcmp->rx_cmp_misc_v1) & RX_CMP_AGG_BUFS) >> |