Commit 60ec7fcf authored by 蒋家盛's avatar 蒋家盛 Committed by David S. Miller
Browse files

qlcnic: potential dereference null pointer of rx_queue->page_ring 



The return value of kcalloc() needs to be checked.
To avoid dereference of null pointer in case of the failure of alloc.
Therefore, it might be better to change the return type of
qlcnic_sriov_alloc_vlans() and return -ENOMEM when alloc fails and
return 0 the others.
Also, qlcnic_sriov_set_guest_vlan_mode() and __qlcnic_pci_sriov_enable()
should deal with the return value of qlcnic_sriov_alloc_vlans().

Fixes: 154d0c81 ("qlcnic: VLAN enhancement for 84XX adapters")
Signed-off-by: default avatarJiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1ade48d0

drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h

+1 −1
Original line number Diff line number Diff line
@@ -201,7 +201,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *, 
				   struct qlcnic_info *, u16);

int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8);

void qlcnic_sriov_free_vlans(struct qlcnic_adapter *);

void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);

int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);

bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *);

void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *,

			      struct qlcnic_vf_info *, u16);

drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c

+9 −3
Original line number Diff line number Diff line
@@ -432,7 +432,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, 
					    struct qlcnic_cmd_args *cmd)

{

	struct qlcnic_sriov *sriov = adapter->ahw->sriov;

	int i, num_vlans;

	int i, num_vlans, ret;

	u16 *vlans;



	if (sriov->allowed_vlans)
@@ -443,7 +443,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, 
	dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n",

		 sriov->num_allowed_vlans);



	qlcnic_sriov_alloc_vlans(adapter);

	ret = qlcnic_sriov_alloc_vlans(adapter);

	if (ret)

		return ret;



	if (!sriov->any_vlan)

		return 0;
@@ -2154,7 +2156,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter) 
	return err;

}



void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)

int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)

{

	struct qlcnic_sriov *sriov = adapter->ahw->sriov;

	struct qlcnic_vf_info *vf;
@@ -2164,7 +2166,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) 
		vf = &sriov->vf_info[i];

		vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans,

					  sizeof(*vf->sriov_vlans), GFP_KERNEL);

		if (!vf->sriov_vlans)

			return -ENOMEM;

	}



	return 0;

}



void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter)

drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c

+3 −1
Original line number Diff line number Diff line
@@ -597,7 +597,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, 
	if (err)

		goto del_flr_queue;



	qlcnic_sriov_alloc_vlans(adapter);

	err = qlcnic_sriov_alloc_vlans(adapter);

	if (err)

		goto del_flr_queue;



	return err;