projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| a9fba688 SL |
1 | From 35e967c49fde037a08c27e21e912bbe3aab8df7f Mon Sep 17 00:00:00 2001 |
| 2 | From: Michael Chan <michael.chan@broadcom.com> | |
| 3 | Date: Mon, 8 Apr 2019 17:39:54 -0400 | |
| 4 | Subject: bnxt_en: Improve RX consumer index validity check. | |
| 5 | ||
| 6 | [ Upstream commit a1b0e4e684e9c300b9e759b46cb7a0147e61ddff ] | |
| 7 | ||
| 8 | There is logic to check that the RX/TPA consumer index is the expected | |
| 9 | index to work around a hardware problem. However, the potentially bad | |
| 10 | consumer index is first used to index into an array to reference an entry. | |
| 11 | This can potentially crash if the bad consumer index is beyond legal | |
| 12 | range. Improve the logic to use the consumer index for dereferencing | |
| 13 | after the validity check and log an error message. | |
| 14 | ||
| 15 | Fixes: fa7e28127a5a ("bnxt_en: Add workaround to detect bad opaque in rx completion (part 2)") | |
| 16 | Signed-off-by: Michael Chan <michael.chan@broadcom.com> | |
| 17 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
| 18 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
| 19 | --- | |
| 20 | drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++--- | |
| 21 | 1 file changed, 7 insertions(+), 3 deletions(-) | |
| 22 | ||
| 23 | diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | |
| 24 | index 0bd93bb7d1a2..a8abb47178be 100644 | |
| 25 | --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c | |
| 26 | +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c | |
| 27 | @@ -1092,6 +1092,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, | |
| 28 | tpa_info = &rxr->rx_tpa[agg_id]; | |
| 29 | ||
| 30 | if (unlikely(cons != rxr->rx_next_cons)) { | |
| 31 | + netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n", | |
| 32 | + cons, rxr->rx_next_cons); | |
| 33 | bnxt_sched_reset(bp, rxr); | |
| 34 | return; | |
| 35 | } | |
| 36 | @@ -1544,15 +1546,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons, | |
| 37 | } | |
| 38 | ||
| 39 | cons = rxcmp->rx_cmp_opaque; | |
| 40 | - rx_buf = &rxr->rx_buf_ring[cons]; | |
| 41 | - data = rx_buf->data; | |
| 42 | - data_ptr = rx_buf->data_ptr; | |
| 43 | if (unlikely(cons != rxr->rx_next_cons)) { | |
| 44 | int rc1 = bnxt_discard_rx(bp, bnapi, raw_cons, rxcmp); | |
| 45 | ||
| 46 | + netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", | |
| 47 | + cons, rxr->rx_next_cons); | |
| 48 | bnxt_sched_reset(bp, rxr); | |
| 49 | return rc1; | |
| 50 | } | |
| 51 | + rx_buf = &rxr->rx_buf_ring[cons]; | |
| 52 | + data = rx_buf->data; | |
| 53 | + data_ptr = rx_buf->data_ptr; | |
| 54 | prefetch(data_ptr); | |
| 55 | ||
| 56 | misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1); | |
| 57 | -- | |
| 58 | 2.19.1 | |
| 59 |