lkml.org 
[lkml]   [2020]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 017/105] ibmvnic: avoid memset null scrq msgs
    Date
    From: Dany Madden <drt@linux.ibm.com>

    [ Upstream commit 9281cf2d584083a450fd65fd27cc5f0e692f6e30 ]

    scrq->msgs could be NULL during device reset, causing Linux to crash.
    So, check before memset scrq->msgs.

    Fixes: c8b2ad0a4a901 ("ibmvnic: Sanitize entire SCRQ buffer on reset")
    Signed-off-by: Dany Madden <drt@linux.ibm.com>
    Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/ibm/ibmvnic.c | 19 +++++++++++++++----
    1 file changed, 15 insertions(+), 4 deletions(-)

    diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
    index 32fc0266d99b1..f892cb4a08f4e 100644
    --- a/drivers/net/ethernet/ibm/ibmvnic.c
    +++ b/drivers/net/ethernet/ibm/ibmvnic.c
    @@ -2857,15 +2857,26 @@ static int reset_one_sub_crq_queue(struct ibmvnic_adapter *adapter,
    {
    int rc;

    + if (!scrq) {
    + netdev_dbg(adapter->netdev,
    + "Invalid scrq reset. irq (%d) or msgs (%p).\n",
    + scrq->irq, scrq->msgs);
    + return -EINVAL;
    + }
    +
    if (scrq->irq) {
    free_irq(scrq->irq, scrq);
    irq_dispose_mapping(scrq->irq);
    scrq->irq = 0;
    }
    -
    - memset(scrq->msgs, 0, 4 * PAGE_SIZE);
    - atomic_set(&scrq->used, 0);
    - scrq->cur = 0;
    + if (scrq->msgs) {
    + memset(scrq->msgs, 0, 4 * PAGE_SIZE);
    + atomic_set(&scrq->used, 0);
    + scrq->cur = 0;
    + } else {
    + netdev_dbg(adapter->netdev, "Invalid scrq reset\n");
    + return -EINVAL;
    + }

    rc = h_reg_sub_crq(adapter->vdev->unit_address, scrq->msg_token,
    4 * PAGE_SIZE, &scrq->crq_num, &scrq->hw_irq);
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-14 18:39    [W:4.037 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site