From: Sasha Levin <sashal@kernel•org>
To: linux-kernel@vger•kernel.org, stable@vger•kernel.org
Cc: Jacob Keller <jacob.e.keller@intel•com>,
Paul Menzel <pmenzel@molgen•mpg.de>,
Konrad Jankowski <konrad0.jankowski@intel•com>,
Tony Nguyen <anthony.l.nguyen@intel•com>,
Sasha Levin <sashal@kernel•org>,
jesse.brandeburg@intel•com, davem@davemloft•net,
edumazet@google•com, kuba@kernel•org, pabeni@redhat•com,
intel-wired-lan@lists•osuosl.org, netdev@vger•kernel.org
Subject: [PATCH AUTOSEL 5.18 085/159] ice: always check VF VSI pointer values
Date: Mon, 30 May 2022 09:23:10 -0400 [thread overview]
Message-ID: <20220530132425.1929512-85-sashal@kernel.org> (raw)
In-Reply-To: <20220530132425.1929512-1-sashal@kernel.org>
From: Jacob Keller <jacob.e.keller@intel•com>
[ Upstream commit baeb705fd6a7245cc1fa69ed991a9cffdf44a174 ]
The ice_get_vf_vsi function can return NULL in some cases, such as if
handling messages during a reset where the VSI is being removed and
recreated.
Several places throughout the driver do not bother to check whether this
VSI pointer is valid. Static analysis tools maybe report issues because
they detect paths where a potentially NULL pointer could be dereferenced.
Fix this by checking the return value of ice_get_vf_vsi everywhere.
Signed-off-by: Jacob Keller <jacob.e.keller@intel•com>
Reviewed-by: Paul Menzel <pmenzel@molgen•mpg.de>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel•com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel•com>
Signed-off-by: Sasha Levin <sashal@kernel•org>
---
drivers/net/ethernet/intel/ice/ice_devlink.c | 5 ++-
drivers/net/ethernet/intel/ice/ice_repr.c | 7 +++-
drivers/net/ethernet/intel/ice/ice_sriov.c | 32 +++++++++++++++++--
drivers/net/ethernet/intel/ice/ice_vf_lib.c | 28 +++++++++++++++-
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 5 +++
.../ethernet/intel/ice/ice_virtchnl_fdir.c | 7 +++-
6 files changed, 77 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_devlink.c b/drivers/net/ethernet/intel/ice/ice_devlink.c
index a230edb38466..4a9de59121d8 100644
--- a/drivers/net/ethernet/intel/ice/ice_devlink.c
+++ b/drivers/net/ethernet/intel/ice/ice_devlink.c
@@ -753,9 +753,12 @@ int ice_devlink_create_vf_port(struct ice_vf *vf)
pf = vf->pf;
dev = ice_pf_to_dev(pf);
- vsi = ice_get_vf_vsi(vf);
devlink_port = &vf->devlink_port;
+ vsi = ice_get_vf_vsi(vf);
+ if (!vsi)
+ return -EINVAL;
+
attrs.flavour = DEVLINK_PORT_FLAVOUR_PCI_VF;
attrs.pci_vf.pf = pf->hw.bus.func;
attrs.pci_vf.vf = vf->vf_id;
diff --git a/drivers/net/ethernet/intel/ice/ice_repr.c b/drivers/net/ethernet/intel/ice/ice_repr.c
index 848f2adea563..a91b81c3088b 100644
--- a/drivers/net/ethernet/intel/ice/ice_repr.c
+++ b/drivers/net/ethernet/intel/ice/ice_repr.c
@@ -293,8 +293,13 @@ static int ice_repr_add(struct ice_vf *vf)
struct ice_q_vector *q_vector;
struct ice_netdev_priv *np;
struct ice_repr *repr;
+ struct ice_vsi *vsi;
int err;
+ vsi = ice_get_vf_vsi(vf);
+ if (!vsi)
+ return -EINVAL;
+
repr = kzalloc(sizeof(*repr), GFP_KERNEL);
if (!repr)
return -ENOMEM;
@@ -313,7 +318,7 @@ static int ice_repr_add(struct ice_vf *vf)
goto err_alloc;
}
- repr->src_vsi = ice_get_vf_vsi(vf);
+ repr->src_vsi = vsi;
repr->vf = vf;
vf->repr = repr;
np = netdev_priv(repr->netdev);
diff --git a/drivers/net/ethernet/intel/ice/ice_sriov.c b/drivers/net/ethernet/intel/ice/ice_sriov.c
index 0c438219f7a3..bb1721f1321d 100644
--- a/drivers/net/ethernet/intel/ice/ice_sriov.c
+++ b/drivers/net/ethernet/intel/ice/ice_sriov.c
@@ -46,7 +46,12 @@ static void ice_free_vf_entries(struct ice_pf *pf)
*/
static void ice_vf_vsi_release(struct ice_vf *vf)
{
- ice_vsi_release(ice_get_vf_vsi(vf));
+ struct ice_vsi *vsi = ice_get_vf_vsi(vf);
+
+ if (WARN_ON(!vsi))
+ return;
+
+ ice_vsi_release(vsi);
ice_vf_invalidate_vsi(vf);
}
@@ -104,6 +109,8 @@ static void ice_dis_vf_mappings(struct ice_vf *vf)
hw = &pf->hw;
vsi = ice_get_vf_vsi(vf);
+ if (WARN_ON(!vsi))
+ return;
dev = ice_pf_to_dev(pf);
wr32(hw, VPINT_ALLOC(vf->vf_id), 0);
@@ -341,6 +348,9 @@ static void ice_ena_vf_q_mappings(struct ice_vf *vf, u16 max_txq, u16 max_rxq)
struct ice_hw *hw = &vf->pf->hw;
u32 reg;
+ if (WARN_ON(!vsi))
+ return;
+
/* set regardless of mapping mode */
wr32(hw, VPLAN_TXQ_MAPENA(vf->vf_id), VPLAN_TXQ_MAPENA_TX_ENA_M);
@@ -386,6 +396,9 @@ static void ice_ena_vf_mappings(struct ice_vf *vf)
{
struct ice_vsi *vsi = ice_get_vf_vsi(vf);
+ if (WARN_ON(!vsi))
+ return;
+
ice_ena_vf_msix_mappings(vf);
ice_ena_vf_q_mappings(vf, vsi->alloc_txq, vsi->alloc_rxq);
}
@@ -1128,6 +1141,8 @@ static struct ice_vf *ice_get_vf_from_pfq(struct ice_pf *pf, u16 pfq)
u16 rxq_idx;
vsi = ice_get_vf_vsi(vf);
+ if (!vsi)
+ continue;
ice_for_each_rxq(vsi, rxq_idx)
if (vsi->rxq_map[rxq_idx] == pfq) {
@@ -1521,8 +1536,15 @@ static int ice_calc_all_vfs_min_tx_rate(struct ice_pf *pf)
static bool
ice_min_tx_rate_oversubscribed(struct ice_vf *vf, int min_tx_rate)
{
- int link_speed_mbps = ice_get_link_speed_mbps(ice_get_vf_vsi(vf));
- int all_vfs_min_tx_rate = ice_calc_all_vfs_min_tx_rate(vf->pf);
+ struct ice_vsi *vsi = ice_get_vf_vsi(vf);
+ int all_vfs_min_tx_rate;
+ int link_speed_mbps;
+
+ if (WARN_ON(!vsi))
+ return false;
+
+ link_speed_mbps = ice_get_link_speed_mbps(vsi);
+ all_vfs_min_tx_rate = ice_calc_all_vfs_min_tx_rate(vf->pf);
/* this VF's previous rate is being overwritten */
all_vfs_min_tx_rate -= vf->min_tx_rate;
@@ -1566,6 +1588,10 @@ ice_set_vf_bw(struct net_device *netdev, int vf_id, int min_tx_rate,
goto out_put_vf;
vsi = ice_get_vf_vsi(vf);
+ if (!vsi) {
+ ret = -EINVAL;
+ goto out_put_vf;
+ }
/* when max_tx_rate is zero that means no max Tx rate limiting, so only
* check if max_tx_rate is non-zero
diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
index 6578059d9479..aefd66a4db80 100644
--- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c
@@ -220,8 +220,10 @@ static void ice_vf_clear_counters(struct ice_vf *vf)
{
struct ice_vsi *vsi = ice_get_vf_vsi(vf);
+ if (vsi)
+ vsi->num_vlan = 0;
+
vf->num_mac = 0;
- vsi->num_vlan = 0;
memset(&vf->mdd_tx_events, 0, sizeof(vf->mdd_tx_events));
memset(&vf->mdd_rx_events, 0, sizeof(vf->mdd_rx_events));
}
@@ -251,6 +253,9 @@ static int ice_vf_rebuild_vsi(struct ice_vf *vf)
struct ice_vsi *vsi = ice_get_vf_vsi(vf);
struct ice_pf *pf = vf->pf;
+ if (WARN_ON(!vsi))
+ return -EINVAL;
+
if (ice_vsi_rebuild(vsi, true)) {
dev_err(ice_pf_to_dev(pf), "failed to rebuild VF %d VSI\n",
vf->vf_id);
@@ -514,6 +519,10 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags)
ice_trigger_vf_reset(vf, flags & ICE_VF_RESET_VFLR, false);
vsi = ice_get_vf_vsi(vf);
+ if (WARN_ON(!vsi)) {
+ err = -EIO;
+ goto out_unlock;
+ }
ice_dis_vf_qs(vf);
@@ -572,6 +581,11 @@ int ice_reset_vf(struct ice_vf *vf, u32 flags)
vf->vf_ops->post_vsi_rebuild(vf);
vsi = ice_get_vf_vsi(vf);
+ if (WARN_ON(!vsi)) {
+ err = -EINVAL;
+ goto out_unlock;
+ }
+
ice_eswitch_update_repr(vsi);
ice_eswitch_replay_vf_mac_rule(vf);
@@ -610,6 +624,9 @@ void ice_dis_vf_qs(struct ice_vf *vf)
{
struct ice_vsi *vsi = ice_get_vf_vsi(vf);
+ if (WARN_ON(!vsi))
+ return;
+
ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id);
ice_vsi_stop_all_rx_rings(vsi);
ice_set_vf_state_qs_dis(vf);
@@ -790,6 +807,9 @@ static int ice_vf_rebuild_host_mac_cfg(struct ice_vf *vf)
u8 broadcast[ETH_ALEN];
int status;
+ if (WARN_ON(!vsi))
+ return -EINVAL;
+
if (ice_is_eswitch_mode_switchdev(vf->pf))
return 0;
@@ -875,6 +895,9 @@ static int ice_vf_rebuild_host_tx_rate_cfg(struct ice_vf *vf)
struct ice_vsi *vsi = ice_get_vf_vsi(vf);
int err;
+ if (WARN_ON(!vsi))
+ return -EINVAL;
+
if (vf->min_tx_rate) {
err = ice_set_min_bw_limit(vsi, (u64)vf->min_tx_rate * 1000);
if (err) {
@@ -938,6 +961,9 @@ void ice_vf_rebuild_host_cfg(struct ice_vf *vf)
struct device *dev = ice_pf_to_dev(vf->pf);
struct ice_vsi *vsi = ice_get_vf_vsi(vf);
+ if (WARN_ON(!vsi))
+ return;
+
ice_vf_set_host_trust_cfg(vf);
if (ice_vf_rebuild_host_mac_cfg(vf))
diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl.c b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
index 2889e050a4c9..5405a0e752cf 100644
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl.c
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl.c
@@ -2392,6 +2392,11 @@ static int ice_vc_ena_vlan_stripping(struct ice_vf *vf)
}
vsi = ice_get_vf_vsi(vf);
+ if (!vsi) {
+ v_ret = VIRTCHNL_STATUS_ERR_PARAM;
+ goto error_param;
+ }
+
if (vsi->inner_vlan_ops.ena_stripping(vsi, ETH_P_8021Q))
v_ret = VIRTCHNL_STATUS_ERR_PARAM;
diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
index 8e38ee2faf58..b74ccbd1591a 100644
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c
@@ -1344,7 +1344,12 @@ static void ice_vf_fdir_dump_info(struct ice_vf *vf)
pf = vf->pf;
hw = &pf->hw;
dev = ice_pf_to_dev(pf);
- vf_vsi = pf->vsi[vf->lan_vsi_idx];
+ vf_vsi = ice_get_vf_vsi(vf);
+ if (!vf_vsi) {
+ dev_dbg(dev, "VF %d: invalid VSI pointer\n", vf->vf_id);
+ return;
+ }
+
vsi_num = ice_get_hw_vsi_num(hw, vf_vsi->idx);
fd_size = rd32(hw, VSIQF_FD_SIZE(vsi_num));
--
2.35.1
next prev parent reply other threads:[~2022-05-30 13:36 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220530132425.1929512-1-sashal@kernel.org>
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 004/159] ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 006/159] selftests/bpf: Fix vfs_link kprobe definition Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 007/159] selftests/bpf: Fix parsing of prog types in UAPI hdr for bpftool sync Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 008/159] ath11k: Change max no of active probe SSID and BSSID to fw capability Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 009/159] selftests/bpf: Fix file descriptor leak in load_kallsyms() Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 010/159] rtw89: ser: fix CAM leaks occurring in L2 reset Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 011/159] rtw89: fix misconfiguration on hw_scan channel time Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 012/159] mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 013/159] b43legacy: Fix assigning negative value to unsigned variable Sasha Levin
2022-05-30 13:21 ` [PATCH AUTOSEL 5.18 014/159] b43: " Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 015/159] ipw2x00: Fix potential NULL dereference in libipw_xmit() Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 016/159] ipv6: fix locking issues with loops over idev->addr_list Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 020/159] libbpf: Fix a bug with checking bpf_probe_read_kernel() support in old kernels Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 021/159] mac80211: minstrel_ht: fix where rate stats are stored (fixes debugfs output) Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 027/159] sfc: ef10: Fix assigning negative value to unsigned variable Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 029/159] rtw88: fix incorrect frequency reported Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 030/159] rtw88: 8821c: fix debugfs rssi value Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 033/159] tcp: consume incoming skb leading to a reset Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 040/159] net: sched: use queue_mapping to pick tx queue Sasha Levin
2022-05-30 18:10 ` Jakub Kicinski
2022-06-05 12:55 ` Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 046/159] net: macb: In ZynqMP initialization make SGMII phy configuration optional Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 047/159] ath9k: fix QCA9561 PA bias level Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 062/159] ath11k: disable spectral scan during spectral deinit Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 068/159] ath10k: skip ath10k_halt during suspend for driver state RESTARTING Sasha Levin
2022-05-30 13:22 ` [PATCH AUTOSEL 5.18 073/159] ath11k: fix warning of not found station for bssid in message Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 075/159] ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 076/159] net/mlx5: use kvfree() for kvzalloc() in mlx5_ct_fs_smfs_matcher_create Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 077/159] net/mlx5: fs, delete the FTE when there are no rules attached to it Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 080/159] mlxsw: spectrum_dcb: Do not warn about priority changes Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 081/159] mlxsw: Treat LLDP packets as control Sasha Levin
2022-05-30 13:23 ` Sasha Levin [this message]
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 090/159] net/mlx5: Increase FW pre-init timeout for health recovery Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 095/159] net: remove two BUG() from skb_checksum_help() Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 108/159] rtlwifi: Use pr_warn instead of WARN_ONCE Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 109/159] mt76: mt7915: accept rx frames with non-standard VHT MCS10-11 Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 110/159] mt76: mt7921: " Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 111/159] mt76: fix encap offload ethernet type check Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 118/159] usbnet: Run unregister_netdev() before unbind() again Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 119/159] Bluetooth: HCI: Add HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN quirk Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 122/159] bnxt_en: Configure ptp filters during bnxt open Sasha Levin
2022-05-30 13:23 ` [PATCH AUTOSEL 5.18 134/159] net: phy: micrel: Allow probing without .driver_data Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 137/159] rtw89: cfo: check mac_id to avoid out-of-bounds Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 144/159] can: mcp251xfd: silence clang's -Wunaligned-access warning Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 146/159] net: ipa: ignore endianness if there is no header Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 148/159] selftests/bpf: Add missing trampoline program type to trampoline_count test Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 152/159] rxrpc: Return an error to sendmsg if call failed Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 153/159] rxrpc, afs: Fix selection of abort codes Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 154/159] afs: Adjust ACK interpretation to try and cope with NAT Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 155/159] eth: tg3: silence the GCC 12 array-bounds warning Sasha Levin
2022-05-30 13:24 ` [PATCH AUTOSEL 5.18 157/159] selftests/bpf: fix btf_dump/btf_dump due to recent clang change Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220530132425.1929512-85-sashal@kernel.org \
--to=sashal@kernel$(echo .)org \
--cc=anthony.l.nguyen@intel$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=intel-wired-lan@lists$(echo .)osuosl.org \
--cc=jacob.e.keller@intel$(echo .)com \
--cc=jesse.brandeburg@intel$(echo .)com \
--cc=konrad0.jankowski@intel$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pmenzel@molgen$(echo .)mpg.de \
--cc=stable@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox