ice: add extra check for null Rx descriptor

[ Upstream commit 1f45ebe0d8fbe6178670b663005f38ef8535db5d ]

In the case where the hardware gives us a null Rx descriptor, it is
theoretically possible that we could call one of our skb-construction
functions with no data pointer, which would cause a panic.

In real life, this will never happen - we only get null RX
descriptors as the final descriptor in a chain of otherwise-valid
descriptors. When this happens, the skb will be extant and we'll just
call ice_add_rx_frag(), which can deal with empty data buffers.

Unfortunately, Coverity does not have intimate knowledge of our
hardware, so we must add a check here.

Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index 2c212f64d99f2e392b2f2adc469527aa9162029a..8b2b9e254d28d0045268bcaa9b1033f531b75905 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -1071,13 +1071,16 @@ static int ice_clean_rx_irq(struct ice_ring *rx_ring, int budget)
                ice_put_rx_buf(rx_ring, rx_buf);
                continue;
 construct_skb:
-               if (skb)
+               if (skb) {
                        ice_add_rx_frag(rx_ring, rx_buf, skb, size);
-               else if (ice_ring_uses_build_skb(rx_ring))
-                       skb = ice_build_skb(rx_ring, rx_buf, &xdp);
-               else
+               } else if (likely(xdp.data)) {
+                       if (ice_ring_uses_build_skb(rx_ring))
+                               skb = ice_build_skb(rx_ring, rx_buf, &xdp);
+                       else
+                               skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
+               } else {
                        skb = ice_construct_skb(rx_ring, rx_buf, &xdp);
-
+               }
                /* exit if we failed to retrieve a buffer */
                if (!skb) {
                        rx_ring->rx_stats.alloc_buf_failed++;