diff options
| author | Edward Cree <ecree@solarflare.com> | 2018-04-27 17:08:41 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-04-28 03:21:07 +0300 |
| commit | ded8b9c761c50d147b20d7de18766fcdb8f5b621 (patch) | |
| tree | 72a1aae23a9906f90d5eb5a19dbe9ebea9680674 /drivers/net | |
| parent | 988bf7243e03ef69238381594e0334a79cef74a6 (diff) | |
| download | linux-ded8b9c761c50d147b20d7de18766fcdb8f5b621.tar.xz | |
sfc: Use filter index rather than ID for rps_flow_id table
efx->type->filter_insert() returns an ID rather than the index that
efx->type->filter_async_insert() used to, which causes it to exceed
efx->type->max_rx_ip_filters on some EF10 configurations, leading to out-
of-bounds array writes.
So, in efx_filter_rfs_work(), convert this back into an index (which is
what the remove call in the expiry path expects, anyway).
Fixes: 3af0f34290f6 ("sfc: replace asynchronous filter operations")
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/ethernet/sfc/rx.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c index 64a94f242027..d2e254f2f72b 100644 --- a/drivers/net/ethernet/sfc/rx.c +++ b/drivers/net/ethernet/sfc/rx.c @@ -839,6 +839,8 @@ static void efx_filter_rfs_work(struct work_struct *data) int rc; rc = efx->type->filter_insert(efx, &req->spec, true); + if (rc >= 0) + rc %= efx->type->max_rx_ip_filters; if (efx->rps_hash_table) { spin_lock_bh(&efx->rps_hash_lock); rule = efx_rps_hash_find(efx, &req->spec); |