Commit aa1d7e12 authored by Brett Creeley's avatar Brett Creeley Committed by Jakub Kicinski

ionic: catch NULL pointer issue on reconfig

It's possible that the driver will dereference a qcq that doesn't exist
when calling ionic_reconfigure_queues(), which causes a page fault BUG.

If a reduction in the number of queues is followed by a different
reconfig such as changing the ring size, the driver can hit a NULL
pointer when trying to clean up non-existent queues.

Fix this by checking to make sure both the qcqs array and qcq entry
exists bofore trying to use and free the entry.

Fixes: 101b40a0 ("ionic: change queue count with no reset")
Signed-off-by: default avatarBrett Creeley <brett@pensando.io>
Signed-off-by: default avatarShannon Nelson <snelson@pensando.io>
Link: https://lore.kernel.org/r/20221017233123.15869-1-snelson@pensando.ioSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d8b57135
...@@ -2817,12 +2817,16 @@ int ionic_reconfigure_queues(struct ionic_lif *lif, ...@@ -2817,12 +2817,16 @@ int ionic_reconfigure_queues(struct ionic_lif *lif,
* than the full array, but leave the qcq shells in place * than the full array, but leave the qcq shells in place
*/ */
for (i = lif->nxqs; i < lif->ionic->ntxqs_per_lif; i++) { for (i = lif->nxqs; i < lif->ionic->ntxqs_per_lif; i++) {
if (lif->txqcqs && lif->txqcqs[i]) {
lif->txqcqs[i]->flags &= ~IONIC_QCQ_F_INTR; lif->txqcqs[i]->flags &= ~IONIC_QCQ_F_INTR;
ionic_qcq_free(lif, lif->txqcqs[i]); ionic_qcq_free(lif, lif->txqcqs[i]);
}
if (lif->rxqcqs && lif->rxqcqs[i]) {
lif->rxqcqs[i]->flags &= ~IONIC_QCQ_F_INTR; lif->rxqcqs[i]->flags &= ~IONIC_QCQ_F_INTR;
ionic_qcq_free(lif, lif->rxqcqs[i]); ionic_qcq_free(lif, lif->rxqcqs[i]);
} }
}
if (err) if (err)
netdev_info(lif->netdev, "%s: failed %d\n", __func__, err); netdev_info(lif->netdev, "%s: failed %d\n", __func__, err);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment