kevin/linux
1
Fork 0
Code

net: enetc: allocate vf_state during PF probes

Browse Source 
In the previous implementation, vf_state is allocated memory only when VF
is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before
VF is enabled to configure the MAC address of VF. If this is the case,
enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null
pointer. The simplified error log is as follows.

root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89
[  173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004
[  173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy
[  173.641973] lr : do_setlink+0x4a8/0xec8
[  173.732292] Call trace:
[  173.734740]  enetc_pf_set_vf_mac+0x3c/0x80
[  173.738847]  __rtnl_newlink+0x530/0x89c
[  173.742692]  rtnl_newlink+0x50/0x7c
[  173.746189]  rtnetlink_rcv_msg+0x128/0x390
[  173.750298]  netlink_rcv_skb+0x60/0x130
[  173.754145]  rtnetlink_rcv+0x18/0x24
[  173.757731]  netlink_unicast+0x318/0x380
[  173.761665]  netlink_sendmsg+0x17c/0x3c8

Fixes: d4fd0404c1 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241031060247.1290941-2-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Wei Fang 2024-10-31 14:02:46 +08:00 committed by Jakub Kicinski
parent 0ead60804b
commit e15c5506dd
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/net/ethernet/freescale/enetc/enetc_pf.c
View File

@ -665,19 +665,11 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs)
if (!num_vfs) { if (!num_vfs) {
enetc_msg_psi_free(pf); enetc_msg_psi_free(pf);
kfree(pf->vf_state);
pf->num_vfs = 0; pf->num_vfs = 0;
pci_disable_sriov(pdev); pci_disable_sriov(pdev);
} else { } else {
pf->num_vfs = num_vfs; pf->num_vfs = num_vfs;
pf->vf_state = kcalloc(num_vfs, sizeof(struct enetc_vf_state),
GFP_KERNEL);
if (!pf->vf_state) {
pf->num_vfs = 0;
return -ENOMEM;
}
err = enetc_msg_psi_init(pf); err = enetc_msg_psi_init(pf);
if (err) { if (err) {
dev_err(&pdev->dev, "enetc_msg_psi_init (%d)\n", err); dev_err(&pdev->dev, "enetc_msg_psi_init (%d)\n", err);
@ -696,7 +688,6 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs)
err_en_sriov: err_en_sriov:
enetc_msg_psi_free(pf); enetc_msg_psi_free(pf);
err_msg_psi: err_msg_psi:
kfree(pf->vf_state);
pf->num_vfs = 0; pf->num_vfs = 0;
return err; return err;
@ -1286,6 +1277,12 @@ static int enetc_pf_probe(struct pci_dev *pdev,
pf = enetc_si_priv(si); pf = enetc_si_priv(si);
pf->si = si; pf->si = si;
pf->total_vfs = pci_sriov_get_totalvfs(pdev); pf->total_vfs = pci_sriov_get_totalvfs(pdev);
if (pf->total_vfs) {
pf->vf_state = kcalloc(pf->total_vfs, sizeof(struct enetc_vf_state),
GFP_KERNEL);
if (!pf->vf_state)
goto err_alloc_vf_state;
}
err = enetc_setup_mac_addresses(node, pf); err = enetc_setup_mac_addresses(node, pf);
if (err) if (err)
@ -1363,6 +1360,8 @@ err_alloc_si_res:
free_netdev(ndev); free_netdev(ndev);
err_alloc_netdev: err_alloc_netdev:
err_setup_mac_addresses: err_setup_mac_addresses:
kfree(pf->vf_state);
err_alloc_vf_state:
enetc_psi_destroy(pdev); enetc_psi_destroy(pdev);
err_psi_create: err_psi_create:
return err; return err;
@ -1389,6 +1388,7 @@ static void enetc_pf_remove(struct pci_dev *pdev)
enetc_free_si_resources(priv); enetc_free_si_resources(priv);
free_netdev(si->ndev); free_netdev(si->ndev);
kfree(pf->vf_state);
enetc_psi_destroy(pdev); enetc_psi_destroy(pdev);
} }