lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 278/542] ice: add extra check for null Rx descriptor
    Date
    From: Mitch Williams <mitch.a.williams@intel.com>

    [ Upstream commit 1f45ebe0d8fbe6178670b663005f38ef8535db5d ]

    In the case where the hardware gives us a null Rx descriptor, it is
    theoretically possible that we could call one of our skb-construction
    functions with no data pointer, which would cause a panic.

    In real life, this will never happen - we only get null RX
    descriptors as the final descriptor in a chain of otherwise-valid
    descriptors. When this happens, the skb will be extant and we'll just
    call ice_add_rx_frag(), which can deal with empty data buffers.

    Unfortunately, Coverity does not have intimate knowledge of our
    hardware, so we must add a check here.

    Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
    Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/intel/ice/ice_txrx.c | 13 ++++++++-----
    1 file changed, 8 insertions(+), 5 deletions(-)

    diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
    index 2c212f64d99f2..8b2b9e254d28d 100644
    --- a/drivers/net/ethernet/intel/ice/ice_txrx.c
    +++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
    @@ -1071,13 +1071,16 @@ static int ice_clean_rx_irq(struct ice_ring *rx_ring, int budget)
    ice_put_rx_buf(rx_ring, rx_buf);
    continue;
    construct_skb:
    - if (skb)
    + if (skb) {
    ice_add_rx_frag(rx_ring, rx_buf, skb, size);
    - else if (ice_ring_uses_build_skb(rx_ring))
    - skb = ice_build_skb(rx_ring, rx_buf, &xdp);
    - else
    + } else if (likely(xdp.data)) {
    + if (ice_ring_uses_build_skb(rx_ring))
    + skb = ice_build_skb(rx_ring, rx_buf, &xdp);
    + else
    + skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
    + } else {
    skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
    -
    + }
    /* exit if we failed to retrieve a buffer */
    if (!skb) {
    rx_ring->rx_stats.alloc_buf_failed++;
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 19:11    [W:2.266 / U:0.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site