|
 |
8fbaf1 |
Date: Wed, 5 Jun 2019 13:55:27 -0400
|
|
|
8fbaf1 |
From: Jonathan Toppins <jtoppins@redhat.com>
|
|
|
8fbaf1 |
To: rhkernel-list@redhat.com
|
|
|
8fbaf1 |
Cc: darcari@redhat.com, linville@redhat.com
|
|
|
8fbaf1 |
Subject: [PATCH RHEL-7 08/12] bnxt_en: Fix uninitialized variable usage in
|
|
|
8fbaf1 |
bnxt_rx_pkt().
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
In bnxt_rx_pkt(), if the driver encounters BD errors, it will recycle
|
|
|
8fbaf1 |
the buffers and jump to the end where the uninitailized variable "len"
|
|
|
8fbaf1 |
is referenced. Fix it by adding a new jump label that will skip
|
|
|
8fbaf1 |
the length update. This is the most correct fix since the length
|
|
|
8fbaf1 |
may not be valid when we get this type of error.
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
Fixes: 6a8788f25625 ("bnxt_en: add support for software dynamic interrupt moderation")
|
|
|
8fbaf1 |
Reported-by: Nathan Chancellor <natechancellor@gmail.com>
|
|
|
8fbaf1 |
Cc: Nathan Chancellor <natechancellor@gmail.com>
|
|
|
8fbaf1 |
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
|
|
|
8fbaf1 |
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
|
|
|
8fbaf1 |
Tested-by: Nathan Chancellor <natechancellor@gmail.com>
|
|
|
8fbaf1 |
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
8fbaf1 |
(cherry picked from commit 0b397b17a4120cb80f7bf89eb30587b3dd9b0d1d)
|
|
|
8fbaf1 |
Bugzilla: 1715161
|
|
|
8fbaf1 |
Build Info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=21964229
|
|
|
8fbaf1 |
Tested: build and boot
|
|
|
8fbaf1 |
Signed-off-by: Jonathan Toppins <jtoppins@redhat.com>
|
|
|
8fbaf1 |
---
|
|
|
8fbaf1 |
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 +++++----
|
|
|
8fbaf1 |
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
|
8fbaf1 |
index 11fbcbb8d67a..6ab79be9f46d 100644
|
|
|
8fbaf1 |
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
|
8fbaf1 |
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
|
|
|
8fbaf1 |
@@ -1617,7 +1617,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
|
|
|
8fbaf1 |
netdev_warn(bp->dev, "RX buffer error %x\n", rx_err);
|
|
|
8fbaf1 |
bnxt_sched_reset(bp, rxr);
|
|
|
8fbaf1 |
}
|
|
|
8fbaf1 |
- goto next_rx;
|
|
|
8fbaf1 |
+ goto next_rx_no_len;
|
|
|
8fbaf1 |
}
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
len = le32_to_cpu(rxcmp->rx_cmp_len_flags_type) >> RX_CMP_LEN_SHIFT;
|
|
|
8fbaf1 |
@@ -1698,12 +1698,13 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
|
|
|
8fbaf1 |
rc = 1;
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
next_rx:
|
|
|
8fbaf1 |
- rxr->rx_prod = NEXT_RX(prod);
|
|
|
8fbaf1 |
- rxr->rx_next_cons = NEXT_RX(cons);
|
|
|
8fbaf1 |
-
|
|
|
8fbaf1 |
cpr->rx_packets += 1;
|
|
|
8fbaf1 |
cpr->rx_bytes += len;
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
+next_rx_no_len:
|
|
|
8fbaf1 |
+ rxr->rx_prod = NEXT_RX(prod);
|
|
|
8fbaf1 |
+ rxr->rx_next_cons = NEXT_RX(cons);
|
|
|
8fbaf1 |
+
|
|
|
8fbaf1 |
next_rx_no_prod_no_len:
|
|
|
8fbaf1 |
*raw_cons = tmp_raw_cons;
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
--
|
|
|
8fbaf1 |
2.16.4
|
|
|
8fbaf1 |
|
|
|
8fbaf1 |
|