| Message ID | 4d61f086-c7b4-4762-b025-0ba5df08968b@moroto.mountain (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next,1/2] igb: Fix an end of loop test | expand |
On Thu, Oct 05, 2023 at 04:57:21PM +0300, Dan Carpenter wrote: > When we exit a list_for_each_entry() without hitting a break statement, > the list iterator isn't NULL, it just point to an offset off the > list_head. In that situation, it wouldn't be too surprising for > entry->free to be true and we end up corrupting memory. > > The way to test for these is to just set a flag. > > Fixes: c1fec890458a ("ethernet/intel: Use list_for_each_entry() helper") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Simon Horman <horms@kernel.org>
On 10/5/2023 6:57 AM, Dan Carpenter wrote: > When we exit a list_for_each_entry() without hitting a break statement, > the list iterator isn't NULL, it just point to an offset off the > list_head. In that situation, it wouldn't be too surprising for > entry->free to be true and we end up corrupting memory. > > The way to test for these is to just set a flag. > > Fixes: c1fec890458a ("ethernet/intel: Use list_for_each_entry() helper") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
> -----Original Message----- > From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of > Jesse Brandeburg > Sent: Monday, October 9, 2023 5:18 PM > To: Dan Carpenter <dan.carpenter@linaro.org>; Jinjie Ruan > <ruanjinjie@huawei.com> > Cc: intel-wired-lan@lists.osuosl.org; kernel-janitors@vger.kernel.org; Eric > Dumazet <edumazet@google.com>; Nguyen, Anthony L > <anthony.l.nguyen@intel.com>; Simon Horman <horms@kernel.org>; > netdev@vger.kernel.org; Keller, Jacob E <jacob.e.keller@intel.com>; Jakub > Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>; David S. > Miller <davem@davemloft.net> > Subject: Re: [Intel-wired-lan] [PATCH net-next 1/2] igb: Fix an end of loop test > > On 10/5/2023 6:57 AM, Dan Carpenter wrote: > > When we exit a list_for_each_entry() without hitting a break > > statement, the list iterator isn't NULL, it just point to an offset > > off the list_head. In that situation, it wouldn't be too surprising > > for > > entry->free to be true and we end up corrupting memory. > > > > The way to test for these is to just set a flag. > > > > Fixes: c1fec890458a ("ethernet/intel: Use list_for_each_entry() > > helper") > > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > > Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com> > > > _______________________________________________ > Intel-wired-lan mailing list > Intel-wired-lan@osuosl.org > https://lists.osuosl.org/mailman/listinfo/intel-wired-lan Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 2ac9dffd0bf8..c45b1e7cde58 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -7857,7 +7857,8 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf, { struct pci_dev *pdev = adapter->pdev; struct vf_data_storage *vf_data = &adapter->vf_data[vf]; - struct vf_mac_filter *entry = NULL; + struct vf_mac_filter *entry; + bool found = false; int ret = 0; if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) && @@ -7888,11 +7889,13 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf, case E1000_VF_MAC_FILTER_ADD: /* try to find empty slot in the list */ list_for_each_entry(entry, &adapter->vf_macs.l, l) { - if (entry->free) + if (entry->free) { + found = true; break; + } } - if (entry && entry->free) { + if (found) { entry->free = false; entry->vf = vf; ether_addr_copy(entry->vf_mac, addr);
When we exit a list_for_each_entry() without hitting a break statement, the list iterator isn't NULL, it just point to an offset off the list_head. In that situation, it wouldn't be too surprising for entry->free to be true and we end up corrupting memory. The way to test for these is to just set a flag. Fixes: c1fec890458a ("ethernet/intel: Use list_for_each_entry() helper") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/net/ethernet/intel/igb/igb_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)