leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ixgbe: Fix set_ringparam in ixgbe to use the same memory pools.

Browse Source 
The adapter rings are kcalloc()'d, but in set_ringparam() in ixgbe_ethtool,
we replace that memory from the vmalloc() pool.  This can result in a NULL
pointer reference when trying to modify the rings at a later time, or on
device removal.

Signed-off-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Peter P Waskiewicz Jr 2008-12-26 01:36:33 -08:00 committed by David S. Miller
parent 7adf1525be
commit d3fa472145
1 changed files with 30 additions and 34 deletions

64
drivers/net/ixgbe/ixgbe_ethtool.c
View File

@ -712,30 +712,15 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
return 0; return 0;
} }
if (adapter->num_tx_queues > adapter->num_rx_queues) temp_ring = kcalloc(adapter->num_tx_queues,
temp_ring = vmalloc(adapter->num_tx_queues * sizeof(struct ixgbe_ring), GFP_KERNEL);
sizeof(struct ixgbe_ring));
else
temp_ring = vmalloc(adapter->num_rx_queues *
sizeof(struct ixgbe_ring));
if (!temp_ring) if (!temp_ring)
return -ENOMEM; return -ENOMEM;
while (test_and_set_bit(__IXGBE_RESETTING, &adapter->state)) while (test_and_set_bit(__IXGBE_RESETTING, &adapter->state))
msleep(1); msleep(1);
if (netif_running(netdev))
ixgbe_down(adapter);
/*
* We can't just free everything and then setup again,
* because the ISRs in MSI-X mode get passed pointers
* to the tx and rx ring structs.
*/
if (new_tx_count != adapter->tx_ring->count) { if (new_tx_count != adapter->tx_ring->count) {
memcpy(temp_ring, adapter->tx_ring,
adapter->num_tx_queues * sizeof(struct ixgbe_ring));
for (i = 0; i < adapter->num_tx_queues; i++) { for (i = 0; i < adapter->num_tx_queues; i++) {
temp_ring[i].count = new_tx_count; temp_ring[i].count = new_tx_count;
err = ixgbe_setup_tx_resources(adapter, &temp_ring[i]); err = ixgbe_setup_tx_resources(adapter, &temp_ring[i]);
@ -747,21 +732,28 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
} }
goto err_setup; goto err_setup;
} }
temp_ring[i].v_idx = adapter->tx_ring[i].v_idx;
} }
if (netif_running(netdev))
for (i = 0; i < adapter->num_tx_queues; i++) netdev->netdev_ops->ndo_stop(netdev);
ixgbe_free_tx_resources(adapter, &adapter->tx_ring[i]); ixgbe_reset_interrupt_capability(adapter);
ixgbe_napi_del_all(adapter);
memcpy(adapter->tx_ring, temp_ring, INIT_LIST_HEAD(&netdev->napi_list);
adapter->num_tx_queues * sizeof(struct ixgbe_ring)); kfree(adapter->tx_ring);
adapter->tx_ring = temp_ring;
temp_ring = NULL;
adapter->tx_ring_count = new_tx_count; adapter->tx_ring_count = new_tx_count;
} }
if (new_rx_count != adapter->rx_ring->count) { temp_ring = kcalloc(adapter->num_rx_queues,
memcpy(temp_ring, adapter->rx_ring, sizeof(struct ixgbe_ring), GFP_KERNEL);
adapter->num_rx_queues * sizeof(struct ixgbe_ring)); if (!temp_ring) {
if (netif_running(netdev))
netdev->netdev_ops->ndo_open(netdev);
return -ENOMEM;
}
if (new_rx_count != adapter->rx_ring->count) {
for (i = 0; i < adapter->num_rx_queues; i++) { for (i = 0; i < adapter->num_rx_queues; i++) {
temp_ring[i].count = new_rx_count; temp_ring[i].count = new_rx_count;
err = ixgbe_setup_rx_resources(adapter, &temp_ring[i]); err = ixgbe_setup_rx_resources(adapter, &temp_ring[i]);
@ -773,13 +765,16 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
} }
goto err_setup; goto err_setup;
} }
temp_ring[i].v_idx = adapter->rx_ring[i].v_idx;
} }
if (netif_running(netdev))
for (i = 0; i < adapter->num_rx_queues; i++) netdev->netdev_ops->ndo_stop(netdev);
ixgbe_free_rx_resources(adapter, &adapter->rx_ring[i]); ixgbe_reset_interrupt_capability(adapter);
ixgbe_napi_del_all(adapter);
memcpy(adapter->rx_ring, temp_ring, INIT_LIST_HEAD(&netdev->napi_list);
adapter->num_rx_queues * sizeof(struct ixgbe_ring)); kfree(adapter->rx_ring);
adapter->rx_ring = temp_ring;
temp_ring = NULL;
adapter->rx_ring_count = new_rx_count; adapter->rx_ring_count = new_rx_count;
} }
@ -787,8 +782,9 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
/* success! */ /* success! */
err = 0; err = 0;
err_setup: err_setup:
ixgbe_init_interrupt_scheme(adapter);
if (netif_running(netdev)) if (netif_running(netdev))
ixgbe_up(adapter); netdev->netdev_ops->ndo_open(netdev);
clear_bit(__IXGBE_RESETTING, &adapter->state); clear_bit(__IXGBE_RESETTING, &adapter->state);
return err; return err;