redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

fm10k: fix possible null pointer deref after kcalloc 

When writing a new default redirection table, we needed to populate
a new RSS table using ethtool_rxfh_indir_default. We populated this
table into a region of memory allocated using kcalloc, but never checked
this for NULL. Fix this by moving the default table generation into
fm10k_write_reta. If this function is passed a table, use it. Otherwise,
generate the default table using ethtool_rxfh_indir_default, 4 at at
time.

Fixes: 0ea7fae440 ("fm10k: use ethtool_rxfh_indir_default for default redirection table")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
hifive-unleashed-5.1
Jacob Keller 2016-04-07 08:21:20 -07:00 committed by Jeff Kirsher
parent 11ec36a974
commit 540a5d8590
2 changed files with 22 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
View File

@ -971,15 +971,29 @@ u32 fm10k_get_reta_size(struct net_device __always_unused *netdev)
void fm10k_write_reta(struct fm10k_intfc *interface, const u32 *indir)
{
u16 rss_i = interface->ring_feature[RING_F_RSS].indices;
struct fm10k_hw *hw = &interface->hw;
int i;
u32 table[4];
int i, j;
/* record entries to reta table */
for (i = 0; i < FM10K_RETA_SIZE; i++, indir += 4) {
u32 reta = indir[0] |
(indir[1] << 8) |
(indir[2] << 16) |
(indir[3] << 24);
for (i = 0; i < FM10K_RETA_SIZE; i++) {
u32 reta, n;
/* generate a new table if we weren't given one */
for (j = 0; j < 4; j++) {
if (indir)
n = indir[i + j];
else
n = ethtool_rxfh_indir_default(i + j, rss_i);
table[j] = n;
}
reta = table[0] |
(table[1] << 8) |
(table[2] << 16) |
(table[3] << 24);
if (interface->reta[i] == reta)
continue;

14
drivers/net/ethernet/intel/fm10k/fm10k_main.c
View File

@ -1927,8 +1927,7 @@ static void fm10k_assign_rings(struct fm10k_intfc *interface)
static void fm10k_init_reta(struct fm10k_intfc *interface)
{
u16 i, rss_i = interface->ring_feature[RING_F_RSS].indices;
struct net_device *netdev = interface->netdev;
u32 reta, *indir;
u32 reta;
/* If the Rx flow indirection table has been configured manually, we
* need to maintain it when possible.
@ -1953,16 +1952,7 @@ static void fm10k_init_reta(struct fm10k_intfc *interface)
}
repopulate_reta:
indir = kcalloc(fm10k_get_reta_size(netdev),
sizeof(indir[0]), GFP_KERNEL);
/* generate redirection table using the default kernel policy */
for (i = 0; i < fm10k_get_reta_size(netdev); i++)
indir[i] = ethtool_rxfh_indir_default(i, rss_i);
fm10k_write_reta(interface, indir);
kfree(indir);
fm10k_write_reta(interface, NULL);
}
/**