[PATCH 2.6.22-rc4] ehea: Fixed possible kernel panic on VLAN packet recv

This patch fixes a possible kernel panic due to not checking the vlan group
when processing received VLAN packets and a malfunction in VLAN/hypervisor
registration.


Signed-off-by: Thomas Klein <redacted>
---


diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea.h patched_kernel/drivers/net/ehea/ehea.h

--- linux-2.6.22-rc4/drivers/net/ehea/ehea.h	2007-06-05 02:57:25.000000000 +0200
+++ patched_kernel/drivers/net/ehea/ehea.h	2007-06-06 12:53:58.000000000 +0200

@@ -39,7 +39,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME	"ehea"
-#define DRV_VERSION	"EHEA_0061"
+#define DRV_VERSION	"EHEA_0064"
 
 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
 	| NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)

diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c patched_kernel/drivers/net/ehea/ehea_main.c

--- linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c	2007-06-05 02:57:25.000000000 +0200
+++ patched_kernel/drivers/net/ehea/ehea_main.c	2007-06-06 12:53:58.000000000 +0200

@@ -451,7 +451,8 @@ static struct ehea_cqe *ehea_proc_rwqes(
 				processed_rq3++;
 			}
 
-			if (cqe->status & EHEA_CQE_VLAN_TAG_XTRACT)
+			if ((cqe->status & EHEA_CQE_VLAN_TAG_XTRACT)
+			    && port->vgrp)
 				vlan_hwaccel_receive_skb(skb, port->vgrp,
 							 cqe->vlan_tag);
 			else

@@ -1910,10 +1911,7 @@ static void ehea_vlan_rx_register(struct
 		goto out;
 	}
 
-	if (grp)
-		memset(cb1->vlan_filter, 0, sizeof(cb1->vlan_filter));
-	else
-		memset(cb1->vlan_filter, 0xFF, sizeof(cb1->vlan_filter));
+	memset(cb1->vlan_filter, 0, sizeof(cb1->vlan_filter));
 
 	hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
 				       H_PORT_CB1, H_PORT_CB1_ALL, cb1);

@@ -1947,7 +1945,7 @@ static void ehea_vlan_rx_add_vid(struct 
 	}
 
 	index = (vid / 64);
-	cb1->vlan_filter[index] |= ((u64)(1 << (vid & 0x3F)));
+	cb1->vlan_filter[index] |= ((u64)(0x8000000000000000 >> (vid & 0x3F)));
 
 	hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
 				       H_PORT_CB1, H_PORT_CB1_ALL, cb1);

@@ -1982,7 +1980,7 @@ static void ehea_vlan_rx_kill_vid(struct
 	}
 
 	index = (vid / 64);
-	cb1->vlan_filter[index] &= ~((u64)(1 << (vid & 0x3F)));
+	cb1->vlan_filter[index] &= ~((u64)(0x8000000000000000 >> (vid & 0x3F)));
 
 	hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id,
 				       H_PORT_CB1, H_PORT_CB1_ALL, cb1);

On Wed, 2007-06-06 at 20:53 +0200, Thomas Klein wrote:

These two seem ripe for splitting into some sort of helper routine.
Which would leave only one place to get it right.

cheers

-- 
Michael Ellerman
OzLabs, IBM Australia Development Lab

wwweb: http://michael.ellerman.id.au
phone: +61 2 6212 1183 (tie line 70 21183)

We do not inherit the earth from our ancestors,
we borrow it from our children. - S.M.A.R.T Person

Michael Ellerman [off-list ref] wrote on 06/07/2007 02:35:00 AM:

On Wed, 2007-06-06 at 20:53 +0200, Thomas Klein wrote:

quoted

This patch fixes a possible kernel panic due to not checking the vlan

group

quoted

when processing received VLAN packets and a malfunction in

VLAN/hypervisor

quoted

registration.


Signed-off-by: Thomas Klein <redacted>
---


diff -Nurp -X dontdiff linux-2.6.22-rc4/drivers/net/ehea/ehea.h

patched_kernel/drivers/net/ehea/ehea.h

quoted

--- linux-2.6.22-rc4/drivers/net/ehea/ehea.h   2007-06-05 02:57:

25.000000000 +0200

quoted

+++ patched_kernel/drivers/net/ehea/ehea.h   2007-06-06 12:53:58.

000000000 +0200

quoted

@@ -39,7 +39,7 @@
 #include <asm/io.h>

 #define DRV_NAME   "ehea"
-#define DRV_VERSION   "EHEA_0061"
+#define DRV_VERSION   "EHEA_0064"

 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
    | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)

diff -Nurp -X dontdiff linux-2.6.22-

rc4/drivers/net/ehea/ehea_main.c

patched_kernel/drivers/net/ehea/ehea_main.c

quoted

--- linux-2.6.22-rc4/drivers/net/ehea/ehea_main.c   2007-06-05 02:

57:25.000000000 +0200

quoted

+++ patched_kernel/drivers/net/ehea/ehea_main.c   2007-06-06 12:

53:58.000000000 +0200

quoted

@@ -1947,7 +1945,7 @@ static void ehea_vlan_rx_add_vid(struct
    }

    index = (vid / 64);
-   cb1->vlan_filter[index] |= ((u64)(1 << (vid & 0x3F)));
+   cb1->vlan_filter[index] |= ((u64)(0x8000000000000000 >> (vid &

0x3F)));

quoted

    hret = ehea_h_modify_ehea_port(adapter->handle,

port->logical_port_id,

quoted

                    H_PORT_CB1, H_PORT_CB1_ALL, cb1);

@@ -1982,7 +1980,7 @@ static void ehea_vlan_rx_kill_vid(struct
    }

    index = (vid / 64);
-   cb1->vlan_filter[index] &= ~((u64)(1 << (vid & 0x3F)));
+   cb1->vlan_filter[index] &= ~((u64)(0x8000000000000000 >> (vid &

0x3F)));

These two seem ripe for splitting into some sort of helper routine.
Which would leave only one place to get it right.

Basically agreed. But as we're already at rc4 I wanted to keep the
patch as least invasive as possible. The modification you suggest
can be implemented as a code improvement in 2.6.23.

Thomas Klein wrote:

This patch fixes a possible kernel panic due to not checking the vlan group
when processing received VLAN packets and a malfunction in VLAN/hypervisor
registration.


Signed-off-by: Thomas Klein <redacted>

applied