* [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01
@ 2021-07-01 18:04 Tony Nguyen
2021-07-01 18:04 ` [PATCH net 01/11] igc: Fix use-after-free error during reset Tony Nguyen
` (11 more replies)
0 siblings, 12 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba; +Cc: Tony Nguyen, netdev
This series contains updates to igb, igc, ixgbe, e1000e, fm10k, and iavf
drivers.
Vinicius fixes a use-after-free issue present in igc and igb.
Tom Rix fixes the return value for igc_read_phy_reg() when the
operation is not supported for igc.
Christophe Jaillet fixes unrolling of PCIe error reporting for ixgbe,
igc, igb, fm10k, e10000e, and iavf.
Alex ensures that q_vector array is not accessed beyond its bounds for
igb.
Jedrzej moves ring assignment to occur after bounds have been checked in
igb.
The following are changes since commit dbe69e43372212527abf48609aba7fc39a6daa27:
Merge tag 'net-next-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
and are available in the git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue 1GbE
Aleksandr Loktionov (1):
igb: Check if num of q_vectors is smaller than max before array access
Christophe JAILLET (6):
ixgbe: Fix an error handling path in 'ixgbe_probe()'
igc: Fix an error handling path in 'igc_probe()'
igb: Fix an error handling path in 'igb_probe()'
fm10k: Fix an error handling path in 'fm10k_probe()'
e1000e: Fix an error handling path in 'e1000_probe()'
iavf: Fix an error handling path in 'iavf_probe()'
Jedrzej Jagielski (1):
igb: Fix position of assignment to *ring
Tom Rix (1):
igc: change default return of igc_read_phy_reg()
Vinicius Costa Gomes (2):
igc: Fix use-after-free error during reset
igb: Fix use-after-free error during reset
drivers/net/ethernet/intel/e1000e/netdev.c | 1 +
drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 1 +
drivers/net/ethernet/intel/iavf/iavf_main.c | 1 +
drivers/net/ethernet/intel/igb/igb_main.c | 15 +++++++++++++--
drivers/net/ethernet/intel/igc/igc.h | 2 +-
drivers/net/ethernet/intel/igc/igc_main.c | 3 +++
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 1 +
7 files changed, 21 insertions(+), 3 deletions(-)
--
2.26.2
^ permalink raw reply [flat|nested] 13+ messages in thread
* [PATCH net 01/11] igc: Fix use-after-free error during reset
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 02/11] igb: " Tony Nguyen
` (10 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba
Cc: Vinicius Costa Gomes, netdev, anthony.l.nguyen, Erez Geva,
Dvora Fuxbrumer
From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Cleans the next descriptor to watch (next_to_watch) when cleaning the
TX ring.
Failure to do so can cause invalid memory accesses. If igc_poll() runs
while the controller is being reset this can lead to the driver try to
free a skb that was already freed.
Log message:
[ 101.525242] refcount_t: underflow; use-after-free.
[ 101.525251] WARNING: CPU: 1 PID: 646 at lib/refcount.c:28 refcount_warn_saturate+0xab/0xf0
[ 101.525259] Modules linked in: sch_etf(E) sch_mqprio(E) rfkill(E) intel_rapl_msr(E) intel_rapl_common(E)
x86_pkg_temp_thermal(E) intel_powerclamp(E) coretemp(E) binfmt_misc(E) kvm_intel(E) kvm(E) irqbypass(E) crc32_pclmul(E)
ghash_clmulni_intel(E) aesni_intel(E) mei_wdt(E) libaes(E) crypto_simd(E) cryptd(E) glue_helper(E) snd_hda_codec_hdmi(E)
rapl(E) intel_cstate(E) snd_hda_intel(E) snd_intel_dspcfg(E) sg(E) soundwire_intel(E) intel_uncore(E) at24(E)
soundwire_generic_allocation(E) iTCO_wdt(E) soundwire_cadence(E) intel_pmc_bxt(E) serio_raw(E) snd_hda_codec(E)
iTCO_vendor_support(E) watchdog(E) snd_hda_core(E) snd_hwdep(E) snd_soc_core(E) snd_compress(E) snd_pcsp(E)
soundwire_bus(E) snd_pcm(E) evdev(E) snd_timer(E) mei_me(E) snd(E) soundcore(E) mei(E) configfs(E) ip_tables(E) x_tables(E)
autofs4(E) ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) sd_mod(E) t10_pi(E) crc_t10dif(E) crct10dif_generic(E)
i915(E) ahci(E) libahci(E) ehci_pci(E) igb(E) xhci_pci(E) ehci_hcd(E)
[ 101.525303] drm_kms_helper(E) dca(E) xhci_hcd(E) libata(E) crct10dif_pclmul(E) cec(E) crct10dif_common(E) tsn(E) igc(E)
e1000e(E) ptp(E) i2c_i801(E) crc32c_intel(E) psmouse(E) i2c_algo_bit(E) i2c_smbus(E) scsi_mod(E) lpc_ich(E) pps_core(E)
usbcore(E) drm(E) button(E) video(E)
[ 101.525318] CPU: 1 PID: 646 Comm: irq/37-enp7s0-T Tainted: G E 5.10.30-rt37-tsn1-rt-ipipe #ipipe
[ 101.525320] Hardware name: SIEMENS AG SIMATIC IPC427D/A5E31233588, BIOS V17.02.09 03/31/2017
[ 101.525322] RIP: 0010:refcount_warn_saturate+0xab/0xf0
[ 101.525325] Code: 05 31 48 44 01 01 e8 f0 c6 42 00 0f 0b c3 80 3d 1f 48 44 01 00 75 90 48 c7 c7 78 a8 f3 a6 c6 05 0f 48
44 01 01 e8 d1 c6 42 00 <0f> 0b c3 80 3d fe 47 44 01 00 0f 85 6d ff ff ff 48 c7 c7 d0 a8 f3
[ 101.525327] RSP: 0018:ffffbdedc0917cb8 EFLAGS: 00010286
[ 101.525329] RAX: 0000000000000000 RBX: ffff98fd6becbf40 RCX: 0000000000000001
[ 101.525330] RDX: 0000000000000001 RSI: ffffffffa6f2700c RDI: 00000000ffffffff
[ 101.525332] RBP: ffff98fd6becc14c R08: ffffffffa7463d00 R09: ffffbdedc0917c50
[ 101.525333] R10: ffffffffa74c3578 R11: 0000000000000034 R12: 00000000ffffff00
[ 101.525335] R13: ffff98fd6b0b1000 R14: 0000000000000039 R15: ffff98fd6be35c40
[ 101.525337] FS: 0000000000000000(0000) GS:ffff98fd6e240000(0000) knlGS:0000000000000000
[ 101.525339] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 101.525341] CR2: 00007f34135a3a70 CR3: 0000000150210003 CR4: 00000000001706e0
[ 101.525343] Call Trace:
[ 101.525346] sock_wfree+0x9c/0xa0
[ 101.525353] unix_destruct_scm+0x7b/0xa0
[ 101.525358] skb_release_head_state+0x40/0x90
[ 101.525362] skb_release_all+0xe/0x30
[ 101.525364] napi_consume_skb+0x57/0x160
[ 101.525367] igc_poll+0xb7/0xc80 [igc]
[ 101.525376] ? sched_clock+0x5/0x10
[ 101.525381] ? sched_clock_cpu+0xe/0x100
[ 101.525385] net_rx_action+0x14c/0x410
[ 101.525388] __do_softirq+0xe9/0x2f4
[ 101.525391] __local_bh_enable_ip+0xe3/0x110
[ 101.525395] ? irq_finalize_oneshot.part.47+0xe0/0xe0
[ 101.525398] irq_forced_thread_fn+0x6a/0x80
[ 101.525401] irq_thread+0xe8/0x180
[ 101.525403] ? wake_threads_waitq+0x30/0x30
[ 101.525406] ? irq_thread_check_affinity+0xd0/0xd0
[ 101.525408] kthread+0x183/0x1a0
[ 101.525412] ? kthread_park+0x80/0x80
[ 101.525415] ret_from_fork+0x22/0x30
Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings")
Reported-by: Erez Geva <erez.geva.ext@siemens.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/igc/igc_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 95323095094d..1d00a63eb935 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -232,6 +232,8 @@ static void igc_clean_tx_ring(struct igc_ring *tx_ring)
igc_unmap_tx_buffer(tx_ring->dev, tx_buffer);
}
+ tx_buffer->next_to_watch = NULL;
+
/* move us one more past the eop_desc for start of next pkt */
tx_buffer++;
i++;
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 02/11] igb: Fix use-after-free error during reset
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
2021-07-01 18:04 ` [PATCH net 01/11] igc: Fix use-after-free error during reset Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 03/11] igc: change default return of igc_read_phy_reg() Tony Nguyen
` (9 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba
Cc: Vinicius Costa Gomes, netdev, anthony.l.nguyen, Erez Geva,
Tony Brelinski
From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Cleans the next descriptor to watch (next_to_watch) when cleaning the
TX ring.
Failure to do so can cause invalid memory accesses. If igb_poll() runs
while the controller is reset this can lead to the driver try to free
a skb that was already freed.
(The crash is harder to reproduce with the igb driver, but the same
potential problem exists as the code is identical to igc)
Fixes: 7cc6fd4c60f2 ("igb: Don't bother clearing Tx buffer_info in igb_clean_tx_ring")
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Reported-by: Erez Geva <erez.geva.ext@siemens.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/igb/igb_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 7e6435dc7e80..a61e2e5e95c0 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -4835,6 +4835,8 @@ static void igb_clean_tx_ring(struct igb_ring *tx_ring)
DMA_TO_DEVICE);
}
+ tx_buffer->next_to_watch = NULL;
+
/* move us one more past the eop_desc for start of next pkt */
tx_buffer++;
i++;
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 03/11] igc: change default return of igc_read_phy_reg()
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
2021-07-01 18:04 ` [PATCH net 01/11] igc: Fix use-after-free error during reset Tony Nguyen
2021-07-01 18:04 ` [PATCH net 02/11] igb: " Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 04/11] ixgbe: Fix an error handling path in 'ixgbe_probe()' Tony Nguyen
` (8 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba; +Cc: Tom Rix, netdev, anthony.l.nguyen, Dvora Fuxbrumer
From: Tom Rix <trix@redhat.com>
Static analysis reports this problem
igc_main.c:4944:20: warning: The left operand of '&'
is a garbage value
if (!(phy_data & SR_1000T_REMOTE_RX_STATUS) &&
~~~~~~~~ ^
phy_data is set by the call to igc_read_phy_reg() only if
there is a read_reg() op, else it is unset and a 0 is
returned. Change the return to -EOPNOTSUPP.
Fixes: 208983f099d9 ("igc: Add watchdog")
Signed-off-by: Tom Rix <trix@redhat.com>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/igc/igc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
index 9e0bbb2e55e3..5901ed9fb545 100644
--- a/drivers/net/ethernet/intel/igc/igc.h
+++ b/drivers/net/ethernet/intel/igc/igc.h
@@ -578,7 +578,7 @@ static inline s32 igc_read_phy_reg(struct igc_hw *hw, u32 offset, u16 *data)
if (hw->phy.ops.read_reg)
return hw->phy.ops.read_reg(hw, offset, data);
- return 0;
+ return -EOPNOTSUPP;
}
void igc_reinit_locked(struct igc_adapter *);
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 04/11] ixgbe: Fix an error handling path in 'ixgbe_probe()'
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (2 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 03/11] igc: change default return of igc_read_phy_reg() Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 05/11] igc: Fix an error handling path in 'igc_probe()' Tony Nguyen
` (7 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba; +Cc: Christophe JAILLET, netdev, anthony.l.nguyen, Tony Brelinski
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.
Fixes: 6fabd715e6d8 ("ixgbe: Implement PCIe AER support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index ffff69efd78a..913253f8ecb4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -11067,6 +11067,7 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
disable_dev = !test_and_set_bit(__IXGBE_DISABLED, &adapter->state);
free_netdev(netdev);
err_alloc_etherdev:
+ pci_disable_pcie_error_reporting(pdev);
pci_release_mem_regions(pdev);
err_pci_reg:
err_dma:
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 05/11] igc: Fix an error handling path in 'igc_probe()'
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (3 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 04/11] ixgbe: Fix an error handling path in 'ixgbe_probe()' Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 06/11] igb: Fix an error handling path in 'igb_probe()' Tony Nguyen
` (6 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba
Cc: Christophe JAILLET, netdev, anthony.l.nguyen, Dvora Fuxbrumer,
Sasha Neftin
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.
Fixes: c9a11c23ceb6 ("igc: Add netdev")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Acked-by: Sasha Neftin <sasha.neftin@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/igc/igc_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 1d00a63eb935..e29aadbc6744 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -6056,6 +6056,7 @@ static int igc_probe(struct pci_dev *pdev,
err_ioremap:
free_netdev(netdev);
err_alloc_etherdev:
+ pci_disable_pcie_error_reporting(pdev);
pci_release_mem_regions(pdev);
err_pci_reg:
err_dma:
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 06/11] igb: Fix an error handling path in 'igb_probe()'
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (4 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 05/11] igc: Fix an error handling path in 'igc_probe()' Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 07/11] fm10k: Fix an error handling path in 'fm10k_probe()' Tony Nguyen
` (5 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba; +Cc: Christophe JAILLET, netdev, anthony.l.nguyen, Tony Brelinski
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.
Fixes: 40a914fa72ab ("igb: Add support for pci-e Advanced Error Reporting")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/igb/igb_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a61e2e5e95c0..abc239b736fb 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3615,6 +3615,7 @@ static int igb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
err_ioremap:
free_netdev(netdev);
err_alloc_etherdev:
+ pci_disable_pcie_error_reporting(pdev);
pci_release_mem_regions(pdev);
err_pci_reg:
err_dma:
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 07/11] fm10k: Fix an error handling path in 'fm10k_probe()'
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (5 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 06/11] igb: Fix an error handling path in 'igb_probe()' Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 08/11] e1000e: Fix an error handling path in 'e1000_probe()' Tony Nguyen
` (4 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba; +Cc: Christophe JAILLET, netdev, anthony.l.nguyen
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.
Fixes: 19ae1b3fb99c ("fm10k: Add support for PCI power management and error handling")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
index dbcae92bb18d..adfa2768f024 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
@@ -2227,6 +2227,7 @@ static int fm10k_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
err_ioremap:
free_netdev(netdev);
err_alloc_netdev:
+ pci_disable_pcie_error_reporting(pdev);
pci_release_mem_regions(pdev);
err_pci_reg:
err_dma:
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 08/11] e1000e: Fix an error handling path in 'e1000_probe()'
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (6 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 07/11] fm10k: Fix an error handling path in 'fm10k_probe()' Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 09/11] iavf: Fix an error handling path in 'iavf_probe()' Tony Nguyen
` (3 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba
Cc: Christophe JAILLET, netdev, anthony.l.nguyen, Sasha Neftin,
Dvora Fuxbrumer
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.
Fixes: 111b9dc5c981 ("e1000e: add aer support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/e1000e/netdev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index d150dade06cf..757a54c39eef 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -7664,6 +7664,7 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
err_ioremap:
free_netdev(netdev);
err_alloc_etherdev:
+ pci_disable_pcie_error_reporting(pdev);
pci_release_mem_regions(pdev);
err_pci_reg:
err_dma:
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 09/11] iavf: Fix an error handling path in 'iavf_probe()'
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (7 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 08/11] e1000e: Fix an error handling path in 'e1000_probe()' Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 10/11] igb: Check if num of q_vectors is smaller than max before array access Tony Nguyen
` (2 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba; +Cc: Christophe JAILLET, netdev, anthony.l.nguyen
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it
must be undone by a corresponding 'pci_disable_pcie_error_reporting()'
call, as already done in the remove function.
Fixes: 5eae00c57f5e ("i40evf: main driver core")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/iavf/iavf_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
index e612c24fa384..44bafedd09f2 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -3798,6 +3798,7 @@ static int iavf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
err_ioremap:
free_netdev(netdev);
err_alloc_etherdev:
+ pci_disable_pcie_error_reporting(pdev);
pci_release_regions(pdev);
err_pci_reg:
err_dma:
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 10/11] igb: Check if num of q_vectors is smaller than max before array access
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (8 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 09/11] iavf: Fix an error handling path in 'iavf_probe()' Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 18:04 ` [PATCH net 11/11] igb: Fix position of assignment to *ring Tony Nguyen
2021-07-01 21:50 ` [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 patchwork-bot+netdevbpf
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba
Cc: Aleksandr Loktionov, netdev, anthony.l.nguyen, Grzegorz Siwik,
Arkadiusz Kubalewski, Slawomir Laba, Sylwester Dziedziuch,
Mateusz Palczewski, Tony Brelinski
From: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed
beyond its size. It was fixed by using a local variable num_q_vectors
as a limit for loop index, and ensure that num_q_vectors is not bigger
than MAX_Q_VECTORS.
Fixes: 047e0030f1e6 ("igb: add new data structure for handling interrupts and NAPI")
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
Reviewed-by: Slawomir Laba <slawomirx.laba@intel.com>
Reviewed-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
Reviewed-by: Mateusz Palczewski <mateusz.placzewski@intel.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/igb/igb_main.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index abc239b736fb..9470ba891483 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -931,6 +931,7 @@ static void igb_configure_msix(struct igb_adapter *adapter)
**/
static int igb_request_msix(struct igb_adapter *adapter)
{
+ unsigned int num_q_vectors = adapter->num_q_vectors;
struct net_device *netdev = adapter->netdev;
int i, err = 0, vector = 0, free_vector = 0;
@@ -939,7 +940,13 @@ static int igb_request_msix(struct igb_adapter *adapter)
if (err)
goto err_out;
- for (i = 0; i < adapter->num_q_vectors; i++) {
+ if (num_q_vectors > MAX_Q_VECTORS) {
+ num_q_vectors = MAX_Q_VECTORS;
+ dev_warn(&adapter->pdev->dev,
+ "The number of queue vectors (%d) is higher than max allowed (%d)\n",
+ adapter->num_q_vectors, MAX_Q_VECTORS);
+ }
+ for (i = 0; i < num_q_vectors; i++) {
struct igb_q_vector *q_vector = adapter->q_vector[i];
vector++;
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH net 11/11] igb: Fix position of assignment to *ring
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (9 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 10/11] igb: Check if num of q_vectors is smaller than max before array access Tony Nguyen
@ 2021-07-01 18:04 ` Tony Nguyen
2021-07-01 21:50 ` [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 patchwork-bot+netdevbpf
11 siblings, 0 replies; 13+ messages in thread
From: Tony Nguyen @ 2021-07-01 18:04 UTC (permalink / raw
To: davem, kuba
Cc: Jedrzej Jagielski, netdev, anthony.l.nguyen, Vinicius Costa Gomes,
Tony Brelinski
From: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
Assignment to *ring should be done after correctness check of the
argument queue.
Fixes: 91db364236c8 ("igb: Refactor igb_configure_cbs()")
Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
drivers/net/ethernet/intel/igb/igb_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 9470ba891483..171a7a629b20 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1685,14 +1685,15 @@ static bool is_any_txtime_enabled(struct igb_adapter *adapter)
**/
static void igb_config_tx_modes(struct igb_adapter *adapter, int queue)
{
- struct igb_ring *ring = adapter->tx_ring[queue];
struct net_device *netdev = adapter->netdev;
struct e1000_hw *hw = &adapter->hw;
+ struct igb_ring *ring;
u32 tqavcc, tqavctrl;
u16 value;
WARN_ON(hw->mac.type != e1000_i210);
WARN_ON(queue < 0 || queue > 1);
+ ring = adapter->tx_ring[queue];
/* If any of the Qav features is enabled, configure queues as SR and
* with HIGH PRIO. If none is, then configure them with LOW PRIO and
--
2.26.2
^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
` (10 preceding siblings ...)
2021-07-01 18:04 ` [PATCH net 11/11] igb: Fix position of assignment to *ring Tony Nguyen
@ 2021-07-01 21:50 ` patchwork-bot+netdevbpf
11 siblings, 0 replies; 13+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-07-01 21:50 UTC (permalink / raw
To: Tony Nguyen; +Cc: davem, kuba, netdev
Hello:
This series was applied to netdev/net.git (refs/heads/master):
On Thu, 1 Jul 2021 11:04:09 -0700 you wrote:
> This series contains updates to igb, igc, ixgbe, e1000e, fm10k, and iavf
> drivers.
>
> Vinicius fixes a use-after-free issue present in igc and igb.
>
> Tom Rix fixes the return value for igc_read_phy_reg() when the
> operation is not supported for igc.
>
> [...]
Here is the summary with links:
- [net,01/11] igc: Fix use-after-free error during reset
https://git.kernel.org/netdev/net/c/56ea7ed103b4
- [net,02/11] igb: Fix use-after-free error during reset
https://git.kernel.org/netdev/net/c/7b292608db23
- [net,03/11] igc: change default return of igc_read_phy_reg()
https://git.kernel.org/netdev/net/c/05682a0a61b6
- [net,04/11] ixgbe: Fix an error handling path in 'ixgbe_probe()'
https://git.kernel.org/netdev/net/c/dd2aefcd5e37
- [net,05/11] igc: Fix an error handling path in 'igc_probe()'
https://git.kernel.org/netdev/net/c/c6bc9e5ce5d3
- [net,06/11] igb: Fix an error handling path in 'igb_probe()'
https://git.kernel.org/netdev/net/c/fea03b1cebd6
- [net,07/11] fm10k: Fix an error handling path in 'fm10k_probe()'
https://git.kernel.org/netdev/net/c/e85e14d68f51
- [net,08/11] e1000e: Fix an error handling path in 'e1000_probe()'
https://git.kernel.org/netdev/net/c/458907560842
- [net,09/11] iavf: Fix an error handling path in 'iavf_probe()'
https://git.kernel.org/netdev/net/c/af30cbd2f4d6
- [net,10/11] igb: Check if num of q_vectors is smaller than max before array access
https://git.kernel.org/netdev/net/c/6c19d772618f
- [net,11/11] igb: Fix position of assignment to *ring
https://git.kernel.org/netdev/net/c/382a7c20d925
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2021-07-01 21:50 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-07-01 18:04 [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 Tony Nguyen
2021-07-01 18:04 ` [PATCH net 01/11] igc: Fix use-after-free error during reset Tony Nguyen
2021-07-01 18:04 ` [PATCH net 02/11] igb: " Tony Nguyen
2021-07-01 18:04 ` [PATCH net 03/11] igc: change default return of igc_read_phy_reg() Tony Nguyen
2021-07-01 18:04 ` [PATCH net 04/11] ixgbe: Fix an error handling path in 'ixgbe_probe()' Tony Nguyen
2021-07-01 18:04 ` [PATCH net 05/11] igc: Fix an error handling path in 'igc_probe()' Tony Nguyen
2021-07-01 18:04 ` [PATCH net 06/11] igb: Fix an error handling path in 'igb_probe()' Tony Nguyen
2021-07-01 18:04 ` [PATCH net 07/11] fm10k: Fix an error handling path in 'fm10k_probe()' Tony Nguyen
2021-07-01 18:04 ` [PATCH net 08/11] e1000e: Fix an error handling path in 'e1000_probe()' Tony Nguyen
2021-07-01 18:04 ` [PATCH net 09/11] iavf: Fix an error handling path in 'iavf_probe()' Tony Nguyen
2021-07-01 18:04 ` [PATCH net 10/11] igb: Check if num of q_vectors is smaller than max before array access Tony Nguyen
2021-07-01 18:04 ` [PATCH net 11/11] igb: Fix position of assignment to *ring Tony Nguyen
2021-07-01 21:50 ` [PATCH net 00/11][pull request] Intel Wired LAN Driver Updates 2021-07-01 patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).