ionic: catch NULL pointer issue on reconfig

[ Upstream commit aa1d7e1267c12e07d979aa34c613716a89029db2 ]

It's possible that the driver will dereference a qcq that doesn't exist
when calling ionic_reconfigure_queues(), which causes a page fault BUG.

If a reduction in the number of queues is followed by a different
reconfig such as changing the ring size, the driver can hit a NULL
pointer when trying to clean up non-existent queues.

Fix this by checking to make sure both the qcqs array and qcq entry
exists bofore trying to use and free the entry.

Fixes: 101b40a0171f ("ionic: change queue count with no reset")
Signed-off-by: Brett Creeley <brett@pensando.io>
Signed-off-by: Shannon Nelson <snelson@pensando.io>
Link: https://lore.kernel.org/r/20221017233123.15869-1-snelson@pensando.io
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index c713a3ee6571b11f6dff99649f741237fb8eb4f6..886c997a3ad14137f78405cf40a26dd68a9a1b9f 100644 (file)
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -2880,11 +2880,15 @@ err_out:
         * than the full array, but leave the qcq shells in place
         */
        for (i = lif->nxqs; i < lif->ionic->ntxqs_per_lif; i++) {
-               lif->txqcqs[i]->flags &= ~IONIC_QCQ_F_INTR;
-               ionic_qcq_free(lif, lif->txqcqs[i]);
+               if (lif->txqcqs && lif->txqcqs[i]) {
+                       lif->txqcqs[i]->flags &= ~IONIC_QCQ_F_INTR;
+                       ionic_qcq_free(lif, lif->txqcqs[i]);
+               }
 
-               lif->rxqcqs[i]->flags &= ~IONIC_QCQ_F_INTR;
-               ionic_qcq_free(lif, lif->rxqcqs[i]);
+               if (lif->rxqcqs && lif->rxqcqs[i]) {
+                       lif->rxqcqs[i]->flags &= ~IONIC_QCQ_F_INTR;
+                       ionic_qcq_free(lif, lif->rxqcqs[i]);
+               }
        }
 
        if (err)