|
 |
8fbaf1 |
Date: Wed, 5 Jun 2019 13:55:20 -0400
|
|
|
8fbaf1 |
From: Jonathan Toppins <jtoppins@redhat.com>
|
|
|
8fbaf1 |
To: rhkernel-list@redhat.com
|
|
|
8fbaf1 |
Cc: darcari@redhat.com, linville@redhat.com
|
|
|
8fbaf1 |
Subject: [PATCH RHEL-7 01/12] bnxt_en: Improve RX consumer index validity
|
|
|
8fbaf1 |
check.
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
There is logic to check that the RX/TPA consumer index is the expected
|
|
|
8fbaf1 |
index to work around a hardware problem. However, the potentially bad
|
|
|
8fbaf1 |
consumer index is first used to index into an array to reference an entry.
|
|
|
8fbaf1 |
This can potentially crash if the bad consumer index is beyond legal
|
|
|
8fbaf1 |
range. Improve the logic to use the consumer index for dereferencing
|
|
|
8fbaf1 |
after the validity check and log an error message.
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
Fixes: fa7e28127a5a ("bnxt_en: Add workaround to detect bad opaque in rx completion (part 2)")
|
|
|
8fbaf1 |
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
|
|
|
8fbaf1 |
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
8fbaf1 |
(cherry picked from commit a1b0e4e684e9c300b9e759b46cb7a0147e61ddff)
|
|
|
8fbaf1 |
Bugzilla: 1715161
|
|
|
8fbaf1 |
Build Info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=21964229
|
|
|
8fbaf1 |
Tested: build and boot
|
|
|
8fbaf1 |
Signed-off-by: Jonathan Toppins <jtoppins@redhat.com>
|
|
|
8fbaf1 |
---
|
|
|
8fbaf1 |
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++---
|
|
|
8fbaf1 |
1 file changed, 7 insertions(+), 3 deletions(-)
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
|
8fbaf1 |
index 2a522010e7fe..421c62187929 100644
|
|
|
8fbaf1 |
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
|
8fbaf1 |
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
|
8fbaf1 |
@@ -1126,6 +1126,8 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
|
|
|
8fbaf1 |
tpa_info = &rxr->rx_tpa[agg_id];
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
if (unlikely(cons != rxr->rx_next_cons)) {
|
|
|
8fbaf1 |
+ netdev_warn(bp->dev, "TPA cons %x != expected cons %x\n",
|
|
|
8fbaf1 |
+ cons, rxr->rx_next_cons);
|
|
|
8fbaf1 |
bnxt_sched_reset(bp, rxr);
|
|
|
8fbaf1 |
return;
|
|
|
8fbaf1 |
}
|
|
|
8fbaf1 |
@@ -1577,15 +1579,17 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
|
|
|
8fbaf1 |
}
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
cons = rxcmp->rx_cmp_opaque;
|
|
|
8fbaf1 |
- rx_buf = &rxr->rx_buf_ring[cons];
|
|
|
8fbaf1 |
- data = rx_buf->data;
|
|
|
8fbaf1 |
- data_ptr = rx_buf->data_ptr;
|
|
|
8fbaf1 |
if (unlikely(cons != rxr->rx_next_cons)) {
|
|
|
8fbaf1 |
int rc1 = bnxt_discard_rx(bp, cpr, raw_cons, rxcmp);
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
+ netdev_warn(bp->dev, "RX cons %x != expected cons %x\n",
|
|
|
8fbaf1 |
+ cons, rxr->rx_next_cons);
|
|
|
8fbaf1 |
bnxt_sched_reset(bp, rxr);
|
|
|
8fbaf1 |
return rc1;
|
|
|
8fbaf1 |
}
|
|
|
8fbaf1 |
+ rx_buf = &rxr->rx_buf_ring[cons];
|
|
|
8fbaf1 |
+ data = rx_buf->data;
|
|
|
8fbaf1 |
+ data_ptr = rx_buf->data_ptr;
|
|
|
8fbaf1 |
prefetch(data_ptr);
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
misc = le32_to_cpu(rxcmp->rx_cmp_misc_v1);
|
|
|
8fbaf1 |
--
|
|
|
8fbaf1 |
2.16.4
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
|