From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A400EC10F14 for ; Mon, 8 Apr 2019 21:40:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6D0E220833 for ; Mon, 8 Apr 2019 21:40:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="RIXgukxD" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726731AbfDHVkK (ORCPT ); Mon, 8 Apr 2019 17:40:10 -0400 Received: from mail-pl1-f193.google.com ([209.85.214.193]:45573 "EHLO mail-pl1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726240AbfDHVkJ (ORCPT ); Mon, 8 Apr 2019 17:40:09 -0400 Received: by mail-pl1-f193.google.com with SMTP id bf11so8054476plb.12 for ; Mon, 08 Apr 2019 14:40:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=AwfJCk7WE+dUUIkjYsGMq1+t8u3b/R35UC9CC8B0Rlg=; b=RIXgukxDRy8PQSeafStQ0BV6jlH3+v70OI0WZSVaCFgwXuRuHdA03rxCmdT1+cQJIB T7g4IDwul4Vk2PjBSAW2KkVpCuaFC9Dp7637L0Zn2FNtufzw8Y+yvhV/d/81z/pofAWA 6fijZ86Yg/WKHl/3NEK5LlgkUPQxihtIjcmvw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=AwfJCk7WE+dUUIkjYsGMq1+t8u3b/R35UC9CC8B0Rlg=; b=Egj2qIA3++F5f6ufigfhbSrSt2NoU3GltMzmIWVA+XFBSd2ppqbkNXe/+jDrIAY1MM 2Eu+mkWtF/J/UnvCymcwh0lMXR3sE6I0osARhpB3Bc21iVrTmJlmGnEPQ/rHs11Aa+YA Tp/BsVbYm8QsbwsrnhfG+S94eQyiKL+Kv5VBcN9ZuW2W29ASI6bC5ccWopagFkLvduue 1mRrVkOGXfO3YtydsQ22Oxaf86PkIU60Mj4pi7KLMWH6ArTtaBcxcGavypzLlEAxerK/ Wex5qnai5DqnkT6s4K3h87F8dCLeAYkdyofLud3tIqK5NlPZzxF/bDIzu2id5EvTNFXg ee+A== X-Gm-Message-State: APjAAAXiaJycny+VEBHwgMgYVrTKajMEZ9+RVWi/WPlfgJMYPqrKDBIu hAjneWCvQXYyJfFewlaKeUAb1g== X-Google-Smtp-Source: APXvYqz7dnHVXfZcDtbO67iACK+gftjEbD1poo3GORJfka+JRdtqCWGVpkopF9Q9xhZX+ki/MEAcCA== X-Received: by 2002:a17:902:47c2:: with SMTP id d2mr32645336plh.277.1554759608319; Mon, 08 Apr 2019 14:40:08 -0700 (PDT) Received: from localhost.dhcp.broadcom.net ([192.19.223.250]) by smtp.gmail.com with ESMTPSA id d25sm41210644pfn.154.2019.04.08.14.40.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 08 Apr 2019 14:40:07 -0700 (PDT) From: Michael Chan To: davem@davemloft.net Cc: netdev@vger.kernel.org Subject: [PATCH net 1/2] bnxt_en: Improve RX consumer index validity check. Date: Mon, 8 Apr 2019 17:39:54 -0400 Message-Id: <1554759595-31506-2-git-send-email-michael.chan@broadcom.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1554759595-31506-1-git-send-email-michael.chan@broadcom.com> References: <1554759595-31506-1-git-send-email-michael.chan@broadcom.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org There is logic to check that the RX/TPA consumer index is the expected index to work around a hardware problem. However, the potentially bad consumer index is first used to index into an array to reference an entry. This can potentially crash if the bad consumer index is beyond legal range. Improve the logic to use the consumer index for dereferencing after the validity check and log an error message. Fixes: fa7e28127a5a ("bnxt_en: Add workaround to detect bad opaque in rx completion (part 2)") Signed-off-by: Michael Chan --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 0bb9d7b..3df847b 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -1133,6 +1133,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr, tpa_info = &rxr->rx_tpa[agg_id]; if (unlikely(cons != rxr->rx_next_cons)) { + netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n", + cons, rxr->rx_next_cons); bnxt_sched_reset(bp, rxr); return; } @@ -1585,15 +1587,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, } cons = rxcmp->rx_cmp_opaque; - rx_buf = &rxr->rx_buf_ring[cons]; - data = rx_buf->data; - data_ptr = rx_buf->data_ptr; if (unlikely(cons != rxr->rx_next_cons)) { int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp); + netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", + cons, rxr->rx_next_cons); bnxt_sched_reset(bp, rxr); return rc1; } + rx_buf = &rxr->rx_buf_ring[cons]; + data = rx_buf->data; + data_ptr = rx_buf->data_ptr; prefetch(data_ptr); misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1); -- 2.5.1