Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4a7a889 authored by Bert Kenward's avatar Bert Kenward Committed by David S. Miller
Browse files

sfc: pass valid pointers from efx_enqueue_unwind 



The bytes_compl and pkts_compl pointers passed to efx_dequeue_buffers
cannot be NULL. Add a paranoid warning to check this condition and fix
the one case where they were NULL.

efx_enqueue_unwind() is called very rarely, during error handling.
Without this fix it would fail with a NULL pointer dereference in
efx_dequeue_buffer, with efx_enqueue_skb in the call stack.

Fixes: e9117e50 ("sfc: Firmware-Assisted TSO version 2")
Reported-by: default avatarJarod Wilson <jarod@redhat.com>
Signed-off-by: default avatarBert Kenward <bkenward@solarflare.com>
Tested-by: default avatarJarod Wilson <jarod@redhat.com>
Acked-by: default avatarJarod Wilson <jarod@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b6b5e8a6

drivers/net/ethernet/sfc/tx.c

+4 −1
Original line number Diff line number Diff line
@@ -77,6 +77,7 @@ static void efx_dequeue_buffer(struct efx_tx_queue *tx_queue, 
	}



	if (buffer->flags & EFX_TX_BUF_SKB) {

		EFX_WARN_ON_PARANOID(!pkts_compl || !bytes_compl);

		(*pkts_compl)++;

		(*bytes_compl) += buffer->skb->len;

		dev_consume_skb_any((struct sk_buff *)buffer->skb);
@@ -426,12 +427,14 @@ static int efx_tx_map_data(struct efx_tx_queue *tx_queue, struct sk_buff *skb, 
static void efx_enqueue_unwind(struct efx_tx_queue *tx_queue)

{

	struct efx_tx_buffer *buffer;

	unsigned int bytes_compl = 0;

	unsigned int pkts_compl = 0;



	/* Work backwards until we hit the original insert pointer value */

	while (tx_queue->insert_count != tx_queue->write_count) {

		--tx_queue->insert_count;

		buffer = __efx_tx_queue_get_insert_buffer(tx_queue);

		efx_dequeue_buffer(tx_queue, buffer, NULL, NULL);

		efx_dequeue_buffer(tx_queue, buffer, &pkts_compl, &bytes_compl);

	}

}