3.16.7-ckt13 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshiaki Makita <makita.toshiaki@xxxxxxxxxxxxx>
commit c0a06ee185f2b785c7bd44c4fb6fcae80f7d1a54 upstream.
When changing the number of rings by ethtool -L, q_vectors are reused,
which causes oops because of uninitialized pointers.
- When an rx is reused as a tx, q_vector->rx.ring is not set to NULL, which
misleads igb_poll() to determine that it has an rx ring although it
actually points to the tx ring.
- When a tx is reused as an rx, q_vector->rx.ring->skb
(q_vector->ring[0].skb) has a value that was used as tx_stats before.
Fix these problems by zeroing it out on reuseing it.
Fixes: 02ef6e1d0b00 ("igb: Fix queue allocation method to accommodate changing during runtime")
Signed-off-by: Toshiaki Makita <makita.toshiaki@xxxxxxxxxxxxx>
Tested-by: Aaron Brown <aaron.f.brown@xxxxxxxxx>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@xxxxxxxxx>
Signed-off-by: Luis Henriques <luis.henriques@xxxxxxxxxxxxx>
---
drivers/net/ethernet/intel/igb/igb_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 4d2dc17fd31b..3bf362078cc5 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1208,6 +1208,8 @@ static int igb_alloc_q_vector(struct igb_adapter *adapter,
q_vector = adapter->q_vector[v_idx];
if (!q_vector)
q_vector = kzalloc(size, GFP_KERNEL);
+ else
+ memset(q_vector, 0, size);
if (!q_vector)
return -ENOMEM;
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html