Commit a41654c3 authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

ixgbe: fix end of loop test in ixgbe_set_vf_macvlan() 



The list iterator in a list_for_each_entry() loop can never be NULL.
If the loop exits without hitting a break then the iterator points
to an offset off the list head and dereferencing it is an out of
bounds access.

Before we transitioned to using list_for_each_entry() loops, then
it was possible for "entry" to be NULL and the comments mention
this.  I have updated the comments to match the new code.

Fixes: c1fec890 ("ethernet/intel: Use list_for_each_entry() helper")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Reviewed-by: default avatarJesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: default avatarRafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: default avatarJacob Keller <jacob.e.keller@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4690aea5

drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c

+10 −9
Original line number Diff line number Diff line
@@ -640,6 +640,7 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter, 
				int vf, int index, unsigned char *mac_addr)

{

	struct vf_macvlans *entry;

	bool found = false;

	int retval = 0;



	if (index <= 1) {
@@ -661,22 +662,22 @@ static int ixgbe_set_vf_macvlan(struct ixgbe_adapter *adapter, 
	if (!index)

		return 0;



	entry = NULL;



	list_for_each_entry(entry, &adapter->vf_mvs.l, l) {

		if (entry->free)

		if (entry->free) {

			found = true;

			break;

		}

	}



	/*

	 * If we traversed the entire list and didn't find a free entry

	 * then we're out of space on the RAR table.  Also entry may

	 * be NULL because the original memory allocation for the list

	 * failed, which is not fatal but does mean we can't support

	 * VF requests for MACVLAN because we couldn't allocate

	 * memory for the list management required.

	 * then we're out of space on the RAR table.  It's also possible

	 * for the &adapter->vf_mvs.l list to be empty because the original

	 * memory allocation for the list failed, which is not fatal but does

	 * mean we can't support VF requests for MACVLAN because we couldn't

	 * allocate memory for the list management required.

	 */

	if (!entry || !entry->free)

	if (!found)

		return -ENOSPC;



	retval = ixgbe_add_mac_filter(adapter, mac_addr, vf);