From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9C93C43218 for ; Fri, 26 Apr 2019 02:32:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A6C8120685 for ; Fri, 26 Apr 2019 02:32:10 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="HYdr7O4p" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728096AbfDZCcI (ORCPT ); Thu, 25 Apr 2019 22:32:08 -0400 Received: from mail-pg1-f194.google.com ([209.85.215.194]:38227 "EHLO mail-pg1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726039AbfDZCcF (ORCPT ); Thu, 25 Apr 2019 22:32:05 -0400 Received: by mail-pg1-f194.google.com with SMTP id j26so821632pgl.5 for ; Thu, 25 Apr 2019 19:32:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=dapKbY+rHzyCpfn0wMM+g4X8yPE8X4H7cCMp8r2hrd0=; b=HYdr7O4paZvbrnY6HpY3EnwTOptVC3gx15o0gEUEAAvDf/IN6e9gC+4P2xcnFPElrr 3Ybaiy5BSvPlDveWkeV/hwH+8TDZ5gu29e8uQZHiEcpbP9h4UER52asYwfaT3SgCYSW5 BvKNlm62Z7g/frt1cUaiGtYxu29OHQUQrq6wY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=dapKbY+rHzyCpfn0wMM+g4X8yPE8X4H7cCMp8r2hrd0=; b=LjQ8KOjHIzgDJn1POVd3AKW6Ph7QFL9Nr9VEsusgHAmkOAExr8BFR7/KNbkkxjK961 xihNblU3ERgw9EoCTOVJsWXqjuRmK4ZL6/KZO9dpFePT+jyxIS9y2zfuWSHZ9sci1IYM v/zNkf/8VNEPEx8uUlHYzxK6jGyk22e+76VQhI14jzEUiQgCaaWKGXERQ2LNQIshwijP ixV6PmQ+kjbyh6vS0EKbDcPa0G/js2TQRqiYLEBStESii+4Eb7PE+Ma0ew1TWEWP1ewc CUr34g9TXlG9+DkpaB9SVO9k4sHxUSGDDvMs1ZWRMiDHK1/PRMu9+JX/lrDUc+DyAYHd HbTQ== X-Gm-Message-State: APjAAAVMpjb20SzZZaIXiRiLqrqgObKZaMTDe/1yUvA15bMmqoYp5AKg 9EM2NYXkGs4LOMG6OaSH8viEjBL5unU= X-Google-Smtp-Source: APXvYqzPWmy5quLj3zp9VsQe370KUECI5EsWbQrmkSuKgxQcIszypHDZld7c9ijFtKvw+CVePUEOCw== X-Received: by 2002:a63:5b0a:: with SMTP id p10mr41641234pgb.282.1556245925279; Thu, 25 Apr 2019 19:32:05 -0700 (PDT) Received: from localhost.localdomain.dhcp.broadcom.net ([192.19.223.250]) by smtp.gmail.com with ESMTPSA id n5sm25690368pgp.80.2019.04.25.19.32.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 25 Apr 2019 19:32:04 -0700 (PDT) From: Michael Chan To: davem@davemloft.net Cc: netdev@vger.kernel.org Subject: [PATCH net 3/6] bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions. Date: Thu, 25 Apr 2019 22:31:52 -0400 Message-Id: <1556245915-5430-4-git-send-email-michael.chan@broadcom.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1556245915-5430-1-git-send-email-michael.chan@broadcom.com> References: <1556245915-5430-1-git-send-email-michael.chan@broadcom.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If we encounter errors during open and proceed to clean up, bnxt_hwrm_ring_free() may crash if the rings we try to free have never been allocated. bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx() may reference pointers that have not been allocated. Fix it by checking for valid fw_ring_id first before calling bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx(). Fixes: 2c61d2117ecb ("bnxt_en: Add helper functions to get firmware CP ring ID.") Signed-off-by: Michael Chan --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 5d02f59..b03669f 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -5135,10 +5135,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) for (i = 0; i < bp->tx_nr_rings; i++) { struct bnxt_tx_ring_info *txr = &bp->tx_ring[i]; struct bnxt_ring_struct *ring = &txr->tx_ring_struct; - u32 cmpl_ring_id; - cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr); if (ring->fw_ring_id != INVALID_HW_RING_ID) { + u32 cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr); + hwrm_ring_free_send_msg(bp, ring, RING_FREE_REQ_RING_TYPE_TX, close_path ? cmpl_ring_id : @@ -5151,10 +5151,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i]; struct bnxt_ring_struct *ring = &rxr->rx_ring_struct; u32 grp_idx = rxr->bnapi->index; - u32 cmpl_ring_id; - cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr); if (ring->fw_ring_id != INVALID_HW_RING_ID) { + u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr); + hwrm_ring_free_send_msg(bp, ring, RING_FREE_REQ_RING_TYPE_RX, close_path ? cmpl_ring_id : @@ -5173,10 +5173,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i]; struct bnxt_ring_struct *ring = &rxr->rx_agg_ring_struct; u32 grp_idx = rxr->bnapi->index; - u32 cmpl_ring_id; - cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr); if (ring->fw_ring_id != INVALID_HW_RING_ID) { + u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr); + hwrm_ring_free_send_msg(bp, ring, type, close_path ? cmpl_ring_id : INVALID_HW_RING_ID); -- 2.5.1