bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions. [Linux 5.1]

bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions. [Linux 5.1]

This Linux kernel change "bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions" is included in the Linux 5.1 release. This change is authored by Michael Chan <michael.chan [at] broadcom.com> on Thu Apr 25 22:31:52 2019 -0400. The commit for this change in Linux stable tree is 1f83391 (patch).

bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions.

If we encounter errors during open and proceed to clean up,
bnxt_hwrm_ring_free() may crash if the rings we try to free have never
been allocated.  bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx()
may reference pointers that have not been allocated.

Fix it by checking for valid fw_ring_id first before calling
bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx().

Fixes: 2c61d2117ecb ("bnxt_en: Add helper functions to get firmware CP ring ID.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

There are 12 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 5d02f59..b03669f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5135,10 +5135,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
    for (i = 0; i < bp->tx_nr_rings; i++) {
        struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
        struct bnxt_ring_struct *ring = &txr->tx_ring_struct;
-       u32 cmpl_ring_id;

-       cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);
        if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+           u32 cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);
+
            hwrm_ring_free_send_msg(bp, ring,
                        RING_FREE_REQ_RING_TYPE_TX,
                        close_path ? cmpl_ring_id :
@@ -5151,10 +5151,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
        struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
        struct bnxt_ring_struct *ring = &rxr->rx_ring_struct;
        u32 grp_idx = rxr->bnapi->index;
-       u32 cmpl_ring_id;

-       cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
        if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+           u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
+
            hwrm_ring_free_send_msg(bp, ring,
                        RING_FREE_REQ_RING_TYPE_RX,
                        close_path ? cmpl_ring_id :
@@ -5173,10 +5173,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path)
        struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
        struct bnxt_ring_struct *ring = &rxr->rx_agg_ring_struct;
        u32 grp_idx = rxr->bnapi->index;
-       u32 cmpl_ring_id;

-       cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
        if (ring->fw_ring_id != INVALID_HW_RING_ID) {
+           u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);
+
            hwrm_ring_free_send_msg(bp, ring, type,
                        close_path ? cmpl_ring_id :
                        INVALID_HW_RING_ID);

Leave a Reply

Your email address will not be published. Required fields are marked *