Commit a41654c3 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

ixgbe: fix end of loop test in ixgbe_set_vf_macvlan()

The list iterator in a list_for_each_entry() loop can never be NULL.
If the loop exits without hitting a break then the iterator points
to an offset off the list head and dereferencing it is an out of
bounds access.

Before we transitioned to using list_for_each_entry() loops, then
it was possible for "entry" to be NULL and the comments mention
this.  I have updated the comments to match the new code.

Fixes: c1fec890 ("ethernet/intel: Use list_for_each_entry() helper")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Reviewed-by: default avatarJesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: default avatarRafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: default avatarJacob Keller <jacob.e.keller@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4690aea5
...@@ -640,6 +640,7 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter, ...@@ -640,6 +640,7 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter,
int vf, int index, unsigned char *mac_addr) int vf, int index, unsigned char *mac_addr)
{ {
struct vf_macvlans *entry; struct vf_macvlans *entry;
bool found = false;
int retval = 0; int retval = 0;
if (index <= 1) { if (index <= 1) {
...@@ -661,22 +662,22 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter, ...@@ -661,22 +662,22 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter,
if (!index) if (!index)
return 0; return 0;
entry = NULL;
list_for_each_entry(entry, &adapter->vf_mvs.l, l) { list_for_each_entry(entry, &adapter->vf_mvs.l, l) {
if (entry->free) if (entry->free) {
found = true;
break; break;
}
} }
/* /*
* If we traversed the entire list and didn't find a free entry * If we traversed the entire list and didn't find a free entry
* then we're out of space on the RAR table. Also entry may * then we're out of space on the RAR table. It's also possible
* be NULL because the original memory allocation for the list * for the &adapter->vf_mvs.l list to be empty because the original
* failed, which is not fatal but does mean we can't support * memory allocation for the list failed, which is not fatal but does
* VF requests for MACVLAN because we couldn't allocate * mean we can't support VF requests for MACVLAN because we couldn't
* memory for the list management required. * allocate memory for the list management required.
*/ */
if (!entry || !entry->free) if (!found)
return -ENOSPC; return -ENOSPC;
retval = ixgbe_add_mac_filter(adapter, mac_addr, vf); retval = ixgbe_add_mac_filter(adapter, mac_addr, vf);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment