| Message ID | 20241031060247.1290941-2-wei.fang@nxp.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | e15c5506dd39885cd047f811a64240e2e8ab401b |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Fix issues when PF sets MAC address for VF | expand |
On Thu, Oct 31, 2024 at 02:02:46PM +0800, Wei Fang wrote: > In the previous implementation, vf_state is allocated memory only when VF > is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before > VF is enabled to configure the MAC address of VF. If this is the case, > enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null > pointer. The simplified error log is as follows. > > root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89 > [ 173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 > [ 173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy > [ 173.641973] lr : do_setlink+0x4a8/0xec8 > [ 173.732292] Call trace: > [ 173.734740] enetc_pf_set_vf_mac+0x3c/0x80 > [ 173.738847] __rtnl_newlink+0x530/0x89c > [ 173.742692] rtnl_newlink+0x50/0x7c > [ 173.746189] rtnetlink_rcv_msg+0x128/0x390 > [ 173.750298] netlink_rcv_skb+0x60/0x130 > [ 173.754145] rtnetlink_rcv+0x18/0x24 > [ 173.757731] netlink_unicast+0x318/0x380 > [ 173.761665] netlink_sendmsg+0x17c/0x3c8 > > Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") > Signed-off-by: Wei Fang <wei.fang@nxp.com> > --- Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com> Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c index 8f6b0bf48139..c95a7c083b0f 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c +++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c @@ -665,19 +665,11 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs) if (!num_vfs) { enetc_msg_psi_free(pf); - kfree(pf->vf_state); pf->num_vfs = 0; pci_disable_sriov(pdev); } else { pf->num_vfs = num_vfs; - pf->vf_state = kcalloc(num_vfs, sizeof(struct enetc_vf_state), - GFP_KERNEL); - if (!pf->vf_state) { - pf->num_vfs = 0; - return -ENOMEM; - } - err = enetc_msg_psi_init(pf); if (err) { dev_err(&pdev->dev, "enetc_msg_psi_init (%d)\n", err); @@ -696,7 +688,6 @@ static int enetc_sriov_configure(struct pci_dev *pdev, int num_vfs) err_en_sriov: enetc_msg_psi_free(pf); err_msg_psi: - kfree(pf->vf_state); pf->num_vfs = 0; return err; @@ -1286,6 +1277,12 @@ static int enetc_pf_probe(struct pci_dev *pdev, pf = enetc_si_priv(si); pf->si = si; pf->total_vfs = pci_sriov_get_totalvfs(pdev); + if (pf->total_vfs) { + pf->vf_state = kcalloc(pf->total_vfs, sizeof(struct enetc_vf_state), + GFP_KERNEL); + if (!pf->vf_state) + goto err_alloc_vf_state; + } err = enetc_setup_mac_addresses(node, pf); if (err) @@ -1363,6 +1360,8 @@ static int enetc_pf_probe(struct pci_dev *pdev, free_netdev(ndev); err_alloc_netdev: err_setup_mac_addresses: + kfree(pf->vf_state); +err_alloc_vf_state: enetc_psi_destroy(pdev); err_psi_create: return err; @@ -1389,6 +1388,7 @@ static void enetc_pf_remove(struct pci_dev *pdev) enetc_free_si_resources(priv); free_netdev(si->ndev); + kfree(pf->vf_state); enetc_psi_destroy(pdev); }
In the previous implementation, vf_state is allocated memory only when VF is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before VF is enabled to configure the MAC address of VF. If this is the case, enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null pointer. The simplified error log is as follows. root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89 [ 173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy [ 173.641973] lr : do_setlink+0x4a8/0xec8 [ 173.732292] Call trace: [ 173.734740] enetc_pf_set_vf_mac+0x3c/0x80 [ 173.738847] __rtnl_newlink+0x530/0x89c [ 173.742692] rtnl_newlink+0x50/0x7c [ 173.746189] rtnetlink_rcv_msg+0x128/0x390 [ 173.750298] netlink_rcv_skb+0x60/0x130 [ 173.754145] rtnetlink_rcv+0x18/0x24 [ 173.757731] netlink_unicast+0x318/0x380 [ 173.761665] netlink_sendmsg+0x17c/0x3c8 Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") Signed-off-by: Wei Fang <wei.fang@nxp.com> --- .../net/ethernet/freescale/enetc/enetc_pf.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)