fm10k: fix possible null pointer deref after kcalloc

When writing a new default redirection table, we needed to populate
a new RSS table using ethtool_rxfh_indir_default. We populated this
table into a region of memory allocated using kcalloc, but never checked
this for NULL. Fix this by moving the default table generation into
fm10k_write_reta. If this function is passed a table, use it. Otherwise,
generate the default table using ethtool_rxfh_indir_default, 4 at at
time.

Fixes: 0ea7fae44094 ("fm10k: use ethtool_rxfh_indir_default for default redirection table")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Orabug: 25394529
(cherry picked from commit 540a5d859010a239a99aba02a9fed7b255c0033e)
Signed-off-by: Jack Vogel <jack.vogel@oracle.com>

diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
index 1707d040f295e6654848c5ba0c710e8d4688e80b..50f3a56101fd7f2e6b6a528dfdd91529539dad05 100644 (file)
--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
@@ -977,15 +977,29 @@ u32 fm10k_get_reta_size(struct net_device __always_unused *netdev)
 
 void fm10k_write_reta(struct fm10k_intfc *interface, const u32 *indir)
 {
+       u16 rss_i = interface->ring_feature[RING_F_RSS].indices;
        struct fm10k_hw *hw = &interface->hw;
-       int i;
+       u32 table[4];
+       int i, j;
 
        /* record entries to reta table */
-       for (i = 0; i < FM10K_RETA_SIZE; i++, indir += 4) {
-               u32 reta = indir[0] |
-                          (indir[1] << 8) |
-                          (indir[2] << 16) |
-                          (indir[3] << 24);
+       for (i = 0; i < FM10K_RETA_SIZE; i++) {
+               u32 reta, n;
+
+               /* generate a new table if we weren't given one */
+               for (j = 0; j < 4; j++) {
+                       if (indir)
+                               n = indir[i + j];
+                       else
+                               n = ethtool_rxfh_indir_default(i + j, rss_i);
+
+                       table[j] = n;
+               }
+
+               reta = table[0] |
+                       (table[1] << 8) |
+                       (table[2] << 16) |
+                       (table[3] << 24);
 
                if (interface->reta[i] == reta)
                        continue;

diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
index 0dd832b2cc80a8526f7c79484d758a4e6a58a861..d7835ec467e735e3e702e22764d5b5da8b3f001c 100644 (file)
--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
@@ -1943,8 +1943,7 @@ static void fm10k_assign_rings(struct fm10k_intfc *interface)
 static void fm10k_init_reta(struct fm10k_intfc *interface)
 {
        u16 i, rss_i = interface->ring_feature[RING_F_RSS].indices;
-       struct net_device *netdev = interface->netdev;
-       u32 reta, *indir;
+       u32 reta;
 
        /* If the netdev is initialized we have to maintain table if possible */
        if (interface->netdev->reg_state != NETREG_UNINITIALIZED) {
@@ -1963,16 +1962,7 @@ static void fm10k_init_reta(struct fm10k_intfc *interface)
        }
 
 repopulate_reta:
-       indir = kcalloc(fm10k_get_reta_size(netdev),
-                       sizeof(indir[0]), GFP_KERNEL);
-
-       /* generate redirection table using the default kernel policy */
-       for (i = 0; i < fm10k_get_reta_size(netdev); i++)
-               indir[i] = ethtool_rxfh_indir_default(i, rss_i);
-
-       fm10k_write_reta(interface, indir);
-
-       kfree(indir);
+       fm10k_write_reta(interface, NULL);
 }
 
 /**