Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net

Jeff Kirsher says:

====================
Intel Wired LAN Driver Updates 2014-08-15

This series contains fixes to i40e only.

Anjali provides two fixes for i40e, first adds a check for non-active
VF before sending admin queue messages to the VFS.  This resolves a
potential kernel panic which would happen whenever we got a Tx hang and
there were VFS that were not up or enabled.  The second fix adds
additional checks so that we do try to access a VF that is not up or
enabled which would dereference a null pointer.

Jesse fixes a i40e PTP bug where the hang detection routine was never
being run when PTP was enabled.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 33 insertions, 13 deletions

diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
index bb7fe98b3a6c..537b6216971d 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
@@ -247,7 +247,7 @@ void i40e_ptp_rx_hang(struct i40e_vsi *vsi)
         u32 prttsyn_stat;
         int n;
 
-        if (pf->flags & I40E_FLAG_PTP)
+        if (!(pf->flags & I40E_FLAG_PTP))
                 return;
 
         prttsyn_stat = rd32(hw, I40E_PRTTSYN_STAT_1);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 89672551dce9..3ac6a0d2f143 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -1003,11 +1003,19 @@ int i40e_pci_sriov_configure(struct pci_dev *pdev, int num_vfs)
 static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode,
                                   u32 v_retval, u8 *msg, u16 msglen)
 {
-        struct i40e_pf *pf = vf->pf;
-        struct i40e_hw *hw = &pf->hw;
-        int abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
+        struct i40e_pf *pf;
+        struct i40e_hw *hw;
+        int abs_vf_id;
         i40e_status aq_ret;
 
+        /* validate the request */
+        if (!vf || vf->vf_id >= vf->pf->num_alloc_vfs)
+                return -EINVAL;
+
+        pf = vf->pf;
+        hw = &pf->hw;
+        abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
+
         /* single place to detect unsuccessful return values */
         if (v_retval) {
                 vf->num_invalid_msgs++;
@@ -1928,17 +1936,20 @@ static void i40e_vc_vf_broadcast(struct i40e_pf *pf,
 {
         struct i40e_hw *hw = &pf->hw;
         struct i40e_vf *vf = pf->vf;
-        int abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
         int i;
 
-        for (i = 0; i < pf->num_alloc_vfs; i++) {
+        for (i = 0; i < pf->num_alloc_vfs; i++, vf++) {
+                int abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
+                /* Not all vfs are enabled so skip the ones that are not */
+                if (!test_bit(I40E_VF_STAT_INIT, &vf->vf_states) &&
+                    !test_bit(I40E_VF_STAT_ACTIVE, &vf->vf_states))
+                        continue;
+
                 /* Ignore return value on purpose - a given VF may fail, but
                  * we need to keep going and send to all of them
                  */
                 i40e_aq_send_msg_to_vf(hw, abs_vf_id, v_opcode, v_retval,
                                        msg, msglen, NULL);
-                vf++;
-                abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
         }
 }
 
@@ -1954,12 +1965,12 @@ void i40e_vc_notify_link_state(struct i40e_pf *pf)
         struct i40e_hw *hw = &pf->hw;
         struct i40e_vf *vf = pf->vf;
         struct i40e_link_status *ls = &pf->hw.phy.link_info;
-        int abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
         int i;
 
         pfe.event = I40E_VIRTCHNL_EVENT_LINK_CHANGE;
         pfe.severity = I40E_PF_EVENT_SEVERITY_INFO;
-        for (i = 0; i < pf->num_alloc_vfs; i++) {
+        for (i = 0; i < pf->num_alloc_vfs; i++, vf++) {
+                int abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
                 if (vf->link_forced) {
                         pfe.event_data.link_event.link_status = vf->link_up;
                         pfe.event_data.link_event.link_speed =
@@ -1972,8 +1983,6 @@ void i40e_vc_notify_link_state(struct i40e_pf *pf)
                 i40e_aq_send_msg_to_vf(hw, abs_vf_id, I40E_VIRTCHNL_OP_EVENT,
                                        0, (u8 *)&pfe, sizeof(pfe),
                                        NULL);
-                vf++;
-                abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id;
         }
 }
 
@@ -2002,7 +2011,18 @@ void i40e_vc_notify_reset(struct i40e_pf *pf)
 void i40e_vc_notify_vf_reset(struct i40e_vf *vf)
 {
         struct i40e_virtchnl_pf_event pfe;
-        int abs_vf_id = vf->vf_id + vf->pf->hw.func_caps.vf_base_id;
+        int abs_vf_id;
+
+        /* validate the request */
+        if (!vf || vf->vf_id >= vf->pf->num_alloc_vfs)
+                return;
+
+        /* verify if the VF is in either init or active before proceeding */
+        if (!test_bit(I40E_VF_STAT_INIT, &vf->vf_states) &&
+            !test_bit(I40E_VF_STAT_ACTIVE, &vf->vf_states))
+                return;
+
+        abs_vf_id = vf->vf_id + vf->pf->hw.func_caps.vf_base_id;
 
         pfe.event = I40E_VIRTCHNL_EVENT_RESET_IMPENDING;
         pfe.severity = I40E_PF_EVENT_SEVERITY_CERTAIN_DOOM;