queue-4.14/bnxt_en-improve-rx-consumer-index-validity-check.patch

   1 From foo@baz Mon Apr 15 07:47:06 CEST 2019
   2 From: Michael Chan <michael.chan@broadcom.com>
   3 Date: Mon, 8 Apr 2019 17:39:54 -0400
   4 Subject: bnxt_en: Improve RX consumer index validity check.
   5
   6 From: Michael Chan <michael.chan@broadcom.com>
   7
   8 [ Upstream commit a1b0e4e684e9c300b9e759b46cb7a0147e61ddff ]
   9
  10 There is logic to check that the RX/TPA consumer index is the expected
  11 index to work around a hardware problem.  However, the potentially bad
  12 consumer index is first used to index into an array to reference an entry.
  13 This can potentially crash if the bad consumer index is beyond legal
  14 range.  Improve the logic to use the consumer index for dereferencing
  15 after the validity check and log an error message.
  16
  17 Fixes: fa7e28127a5a ("bnxt_en: Add workaround to detect bad opaque in rx completion (part 2)")
  18 Signed-off-by: Michael Chan <michael.chan@broadcom.com>
  19 Signed-off-by: David S. Miller <davem@davemloft.net>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  21 ---
  22  drivers/net/ethernet/broadcom/bnxt/bnxt.c |   10 +++++++---
  23  1 file changed, 7 insertions(+), 3 deletions(-)
  24
  25 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
  26 +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
  27 @@ -1076,6 +1076,8 @@ static void bnxt_tpa_start(struct bnxt *
  28         tpa_info = &rxr->rx_tpa[agg_id];
  29
  30         if (unlikely(cons != rxr->rx_next_cons)) {
  31 +               netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n",
  32 +                           cons, rxr->rx_next_cons);
  33                 bnxt_sched_reset(bp, rxr);
  34                 return;
  35         }
  36 @@ -1528,15 +1530,17 @@ static int bnxt_rx_pkt(struct bnxt *bp,
  37         }
  38
  39         cons = rxcmp->rx_cmp_opaque;
  40 -       rx_buf = &rxr->rx_buf_ring[cons];
  41 -       data = rx_buf->data;
  42 -       data_ptr = rx_buf->data_ptr;
  43         if (unlikely(cons != rxr->rx_next_cons)) {
  44                 int rc1 = bnxt_discard_rx(bp, bnapi, raw_cons, rxcmp);
  45
  46 +               netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
  47 +                           cons, rxr->rx_next_cons);
  48                 bnxt_sched_reset(bp, rxr);
  49                 return rc1;
  50         }
  51 +       rx_buf = &rxr->rx_buf_ring[cons];
  52 +       data = rx_buf->data;
  53 +       data_ptr = rx_buf->data_ptr;
  54         prefetch(data_ptr);
  55
  56         misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1);