diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2023-10-19 10:32:26 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-10-20 12:53:06 +0100 |
| commit | 4690aea589e76e887a40195b35b6d19a838058eb (patch) | |
| tree | 50c97863fbc73fadaaea6957d39bf921fef5e0f0 | |
| parent | 640a65f801338940ed86992179558eb070db75de (diff) | |
| download | lwn-4690aea589e76e887a40195b35b6d19a838058eb.tar.gz lwn-4690aea589e76e887a40195b35b6d19a838058eb.zip | |
igb: Fix an end of loop test
When we exit a list_for_each_entry() without hitting a break statement,
the list iterator isn't NULL, it just point to an offset off the
list_head. In that situation, it wouldn't be too surprising for
entry->free to be true and we end up corrupting memory.
The way to test for these is to just set a flag.
Fixes: c1fec890458a ("ethernet/intel: Use list_for_each_entry() helper")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/intel/igb/igb_main.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index db54453e1946..b2295caa2f0a 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -7856,7 +7856,8 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf, { struct pci_dev *pdev = adapter->pdev; struct vf_data_storage *vf_data = &adapter->vf_data[vf]; - struct vf_mac_filter *entry = NULL; + struct vf_mac_filter *entry; + bool found = false; int ret = 0; if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) && @@ -7887,11 +7888,13 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf, case E1000_VF_MAC_FILTER_ADD: /* try to find empty slot in the list */ list_for_each_entry(entry, &adapter->vf_macs.l, l) { - if (entry->free) + if (entry->free) { + found = true; break; + } } - if (entry && entry->free) { + if (found) { entry->free = false; entry->vf = vf; ether_addr_copy(entry->vf_mac, addr); |