2007-06-06 18:53:31

by Thomas Klein

[permalink] [raw]
Subject: [PATCH 2.6.22-rc4] ehea: Fixed possible kernel panic on VLAN packet recv

This patch fixes a possible kernel panic due to not checking the vlan group
when processing received VLAN packets and a malfunction in VLAN/hypervisor
registration.


Signed-off-by: Thomas Klein <[email protected]>
---


diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea.h patched_kernel/drivers/net/ehea/ehea.h
--- linux-2.6.22-rc4/drivers/net/ehea/ehea.h 2007-06-05 02:57:25.000000000 +0200
+++ patched_kernel/drivers/net/ehea/ehea.h 2007-06-06 12:53:58.000000000 +0200
@@ -39,7 +39,7 @@
#include <asm/io.h>

#define DRV_NAME "ehea"
-#define DRV_VERSION "EHEA_0061"
+#define DRV_VERSION "EHEA_0064"

#define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
| NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c patched_kernel/drivers/net/ehea/ehea_main.c
--- linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c 2007-06-05 02:57:25.000000000 +0200
+++ patched_kernel/drivers/net/ehea/ehea_main.c 2007-06-06 12:53:58.000000000 +0200
@@ -451,7 +451,8 @@ static struct ehea_cqe *ehea_proc_rwqes(
processed_rq3++;
}

- if (cqe->status & EHEA_CQE_VLAN_TAG_XTRACT)
+ if ((cqe->status & EHEA_CQE_VLAN_TAG_XTRACT)
+ && port->vgrp)
vlan_hwaccel_receive_skb(skb, port->vgrp,
cqe->vlan_tag);
else
@@ -1910,10 +1911,7 @@ static void ehea_vlan_rx_register(struct
goto out;
}

- if (grp)
- memset(cb1->vlan_filter, 0, sizeof(cb1->vlan_filter));
- else
- memset(cb1->vlan_filter, 0xFF, sizeof(cb1->vlan_filter));
+ memset(cb1->vlan_filter, 0, sizeof(cb1->vlan_filter));

hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
H_PORT_CB1, H_PORT_CB1_ALL, cb1);
@@ -1947,7 +1945,7 @@ static void ehea_vlan_rx_add_vid(struct
}

index = (vid / 64);
- cb1->vlan_filter[index] |= ((u64)(1 << (vid & 0x3F)));
+ cb1->vlan_filter[index] |= ((u64)(0x8000000000000000 >> (vid & 0x3F)));

hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
H_PORT_CB1, H_PORT_CB1_ALL, cb1);
@@ -1982,7 +1980,7 @@ static void ehea_vlan_rx_kill_vid(struct
}

index = (vid / 64);
- cb1->vlan_filter[index] &= ~((u64)(1 << (vid & 0x3F)));
+ cb1->vlan_filter[index] &= ~((u64)(0x8000000000000000 >> (vid & 0x3F)));

hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
H_PORT_CB1, H_PORT_CB1_ALL, cb1);


2007-06-07 00:35:22

by Michael Ellerman

[permalink] [raw]
Subject: Re: [PATCH 2.6.22-rc4] ehea: Fixed possible kernel panic on VLAN packet recv

On Wed, 2007-06-06 at 20:53 +0200, Thomas Klein wrote:
> This patch fixes a possible kernel panic due to not checking the vlan group
> when processing received VLAN packets and a malfunction in VLAN/hypervisor
> registration.
>
>
> Signed-off-by: Thomas Klein <[email protected]>
> ---
>
>
> diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea.h patched_kernel/drivers/net/ehea/ehea.h
> --- linux-2.6.22-rc4/drivers/net/ehea/ehea.h 2007-06-05 02:57:25.000000000 +0200
> +++ patched_kernel/drivers/net/ehea/ehea.h 2007-06-06 12:53:58.000000000 +0200
> @@ -39,7 +39,7 @@
> #include <asm/io.h>
>
> #define DRV_NAME "ehea"
> -#define DRV_VERSION "EHEA_0061"
> +#define DRV_VERSION "EHEA_0064"
>
> #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
> | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
> diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c patched_kernel/drivers/net/ehea/ehea_main.c
> --- linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c 2007-06-05 02:57:25.000000000 +0200
> +++ patched_kernel/drivers/net/ehea/ehea_main.c 2007-06-06 12:53:58.000000000 +0200
> @@ -1947,7 +1945,7 @@ static void ehea_vlan_rx_add_vid(struct
> }
>
> index = (vid / 64);
> - cb1->vlan_filter[index] |= ((u64)(1 << (vid & 0x3F)));
> + cb1->vlan_filter[index] |= ((u64)(0x8000000000000000 >> (vid & 0x3F)));
>
> hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
> H_PORT_CB1, H_PORT_CB1_ALL, cb1);
> @@ -1982,7 +1980,7 @@ static void ehea_vlan_rx_kill_vid(struct
> }
>
> index = (vid / 64);
> - cb1->vlan_filter[index] &= ~((u64)(1 << (vid & 0x3F)));
> + cb1->vlan_filter[index] &= ~((u64)(0x8000000000000000 >> (vid & 0x3F)));

These two seem ripe for splitting into some sort of helper routine.
Which would leave only one place to get it right.

cheers

--
Michael Ellerman
OzLabs, IBM Australia Development Lab

wwweb: http://michael.ellerman.id.au
phone: +61 2 6212 1183 (tie line 70 21183)

We do not inherit the earth from our ancestors,
we borrow it from our children. - S.M.A.R.T Person


Attachments:
signature.asc (189.00 B)
This is a digitally signed message part

2007-06-07 08:15:16

by Thomas Klein

[permalink] [raw]
Subject: Re: [PATCH 2.6.22-rc4] ehea: Fixed possible kernel panic on VLAN packet recv

Michael Ellerman <[email protected]> wrote on 06/07/2007 02:35:00 AM:

> On Wed, 2007-06-06 at 20:53 +0200, Thomas Klein wrote:
> > This patch fixes a possible kernel panic due to not checking the vlan
group
> > when processing received VLAN packets and a malfunction in
VLAN/hypervisor
> > registration.
> >
> >
> > Signed-off-by: Thomas Klein <[email protected]>
> > ---
> >
> >
> > diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea.h
> patched_kernel/drivers/net/ehea/ehea.h
> > --- linux-2.6.22-rc4/drivers/net/ehea/ehea.h 2007-06-05 02:57:
> 25.000000000 +0200
> > +++ patched_kernel/drivers/net/ehea/ehea.h 2007-06-06 12:53:58.
> 000000000 +0200
> > @@ -39,7 +39,7 @@
> > #include <asm/io.h>
> >
> > #define DRV_NAME "ehea"
> > -#define DRV_VERSION "EHEA_0061"
> > +#define DRV_VERSION "EHEA_0064"
> >
> > #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
> > | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
> > diff -Nurp -X dontdiff linux-2.6.22-
> rc4/drivers/net/ehea/ehea_main.c
patched_kernel/drivers/net/ehea/ehea_main.c
> > --- linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c 2007-06-05 02:
> 57:25.000000000 +0200
> > +++ patched_kernel/drivers/net/ehea/ehea_main.c 2007-06-06 12:
> 53:58.000000000 +0200
> > @@ -1947,7 +1945,7 @@ static void ehea_vlan_rx_add_vid(struct
> > }
> >
> > index = (vid / 64);
> > - cb1->vlan_filter[index] |= ((u64)(1 << (vid & 0x3F)));
> > + cb1->vlan_filter[index] |= ((u64)(0x8000000000000000 >> (vid &
0x3F)));
> >
> > hret = ehea_h_modify_ehea_port(adapter->handle,
port->logical_port_id,
> > H_PORT_CB1, H_PORT_CB1_ALL, cb1);
> > @@ -1982,7 +1980,7 @@ static void ehea_vlan_rx_kill_vid(struct
> > }
> >
> > index = (vid / 64);
> > - cb1->vlan_filter[index] &= ~((u64)(1 << (vid & 0x3F)));
> > + cb1->vlan_filter[index] &= ~((u64)(0x8000000000000000 >> (vid &
0x3F)));
>
> These two seem ripe for splitting into some sort of helper routine.
> Which would leave only one place to get it right.
>
Basically agreed. But as we're already at rc4 I wanted to keep the
patch as least invasive as possible. The modification you suggest
can be implemented as a code improvement in 2.6.23.

2007-06-09 22:26:50

by Jeff Garzik

[permalink] [raw]
Subject: Re: [PATCH 2.6.22-rc4] ehea: Fixed possible kernel panic on VLAN packet recv

Thomas Klein wrote:
> This patch fixes a possible kernel panic due to not checking the vlan group
> when processing received VLAN packets and a malfunction in VLAN/hypervisor
> registration.
>
>
> Signed-off-by: Thomas Klein <[email protected]>

applied