* [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
@ 2013-08-13 18:45 Nithin Nayak Sujir
2013-08-15 8:07 ` David Miller
0 siblings, 1 reply; 7+ messages in thread
From: Nithin Nayak Sujir @ 2013-08-13 18:45 UTC (permalink / raw)
To: davem
Cc: netdev, Daniel Borkmann, Gavin Shan, Michael Chan, Nithin Nayak Sujir
From: Daniel Borkmann <dborkman@redhat.com>
Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
condition is met and netdev is NULL. Then, the jump to the 'done' label
calls dev_close() with a netdevice that is NULL. Therefore, only call
dev_close() when we have a netdevice, but one that is not running.
[ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
Nayak Sujir ]
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
Cc: Michael Chan <mchan@broadcom.com>
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
---
drivers/net/ethernet/broadcom/tg3.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index ddebc7a..0da2214 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -17796,8 +17796,10 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,
done:
if (state == pci_channel_io_perm_failure) {
- tg3_napi_enable(tp);
- dev_close(netdev);
+ if (netdev) {
+ tg3_napi_enable(tp);
+ dev_close(netdev);
+ }
err = PCI_ERS_RESULT_DISCONNECT;
} else {
pci_disable_device(pdev);
@@ -17827,7 +17829,8 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
rtnl_lock();
if (pci_enable_device(pdev)) {
- netdev_err(netdev, "Cannot re-enable PCI device after reset.\n");
+ dev_err(&pdev->dev,
+ "Cannot re-enable PCI device after reset.\n");
goto done;
}
@@ -17835,7 +17838,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
pci_restore_state(pdev);
pci_save_state(pdev);
- if (!netif_running(netdev)) {
+ if (!netdev || !netif_running(netdev)) {
rc = PCI_ERS_RESULT_RECOVERED;
goto done;
}
@@ -17847,7 +17850,7 @@ static pci_ers_result_t tg3_io_slot_reset(struct pci_dev *pdev)
rc = PCI_ERS_RESULT_RECOVERED;
done:
- if (rc != PCI_ERS_RESULT_RECOVERED && netif_running(netdev)) {
+ if (rc != PCI_ERS_RESULT_RECOVERED && netdev && netif_running(netdev)) {
tg3_napi_enable(tp);
dev_close(netdev);
}
--
1.8.1.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
2013-08-13 18:45 [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset Nithin Nayak Sujir
@ 2013-08-15 8:07 ` David Miller
2013-08-15 10:57 ` Dmitry Kravkov
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: David Miller @ 2013-08-15 8:07 UTC (permalink / raw)
To: nsujir; +Cc: netdev, dborkman, shangw, mchan
From: "Nithin Nayak Sujir" <nsujir@broadcom.com>
Date: Tue, 13 Aug 2013 11:45:13 -0700
> From: Daniel Borkmann <dborkman@redhat.com>
>
> Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
> NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
> condition is met and netdev is NULL. Then, the jump to the 'done' label
> calls dev_close() with a netdevice that is NULL. Therefore, only call
> dev_close() when we have a netdevice, but one that is not running.
>
> [ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
> Nayak Sujir ]
>
> Reported-by: Dave Jones <davej@redhat.com>
> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
> Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
> Cc: Michael Chan <mchan@broadcom.com>
> Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
Can I get some reviews from the Broadcom folks?
Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
2013-08-15 8:07 ` David Miller
@ 2013-08-15 10:57 ` Dmitry Kravkov
2013-08-15 15:15 ` Michael Chan
2013-08-15 17:32 ` Nithin Nayak Sujir
2 siblings, 0 replies; 7+ messages in thread
From: Dmitry Kravkov @ 2013-08-15 10:57 UTC (permalink / raw)
To: David Miller; +Cc: nsujir, netdev, dborkman, shangw, Michael Chan
On Thu, Aug 15, 2013 at 11:07 AM, David Miller <davem@davemloft.net> wrote:
>
> From: "Nithin Nayak Sujir" <nsujir@broadcom.com>
> Date: Tue, 13 Aug 2013 11:45:13 -0700
>
> > From: Daniel Borkmann <dborkman@redhat.com>
> >
> > Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
> > NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
> > condition is met and netdev is NULL. Then, the jump to the 'done' label
> > calls dev_close() with a netdevice that is NULL. Therefore, only call
> > dev_close() when we have a netdevice, but one that is not running.
> >
> > [ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
> > Nayak Sujir ]
> >
> > Reported-by: Dave Jones <davej@redhat.com>
> > Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
> > Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
> > Cc: Michael Chan <mchan@broadcom.com>
> > Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
>
> Can I get some reviews from the Broadcom folks?
>
> Thanks.
You already have:
Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
2013-08-15 8:07 ` David Miller
2013-08-15 10:57 ` Dmitry Kravkov
@ 2013-08-15 15:15 ` Michael Chan
2013-08-15 20:41 ` David Miller
2013-08-15 17:32 ` Nithin Nayak Sujir
2 siblings, 1 reply; 7+ messages in thread
From: Michael Chan @ 2013-08-15 15:15 UTC (permalink / raw)
To: David Miller; +Cc: nsujir, netdev, dborkman, shangw
On Thu, 2013-08-15 at 01:07 -0700, David Miller wrote:
> From: "Nithin Nayak Sujir" <nsujir@broadcom.com>
> Date: Tue, 13 Aug 2013 11:45:13 -0700
>
> > From: Daniel Borkmann <dborkman@redhat.com>
> >
> > Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
> > NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
> > condition is met and netdev is NULL. Then, the jump to the 'done' label
> > calls dev_close() with a netdevice that is NULL. Therefore, only call
> > dev_close() when we have a netdevice, but one that is not running.
> >
> > [ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
> > Nayak Sujir ]
> >
> > Reported-by: Dave Jones <davej@redhat.com>
> > Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
> > Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
> > Cc: Michael Chan <mchan@broadcom.com>
> > Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
>
> Can I get some reviews from the Broadcom folks?
>
We worked with Daniel at Red Hat and Gavin at IBM on this patch.
Thanks.
Signed-off-by: Michael Chan <mchan@broadcom.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
2013-08-15 8:07 ` David Miller
2013-08-15 10:57 ` Dmitry Kravkov
2013-08-15 15:15 ` Michael Chan
@ 2013-08-15 17:32 ` Nithin Nayak Sujir
2013-08-15 20:17 ` David Miller
2 siblings, 1 reply; 7+ messages in thread
From: Nithin Nayak Sujir @ 2013-08-15 17:32 UTC (permalink / raw)
To: David Miller; +Cc: netdev, dborkman, shangw, mchan
>> Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
>> Cc: Michael Chan <mchan@broadcom.com>
>> Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
>
> Can I get some reviews from the Broadcom folks?
>
David,
I made the additional changes to Daniel's patch and Michael Chan reviewed it
before I submitted.
Sorry, I forgot to add Michael's Signed-off-by. Do you want me to resend it with
his Signed-off-by added?
Thanks,
Nithin.
> Thanks.
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
2013-08-15 17:32 ` Nithin Nayak Sujir
@ 2013-08-15 20:17 ` David Miller
0 siblings, 0 replies; 7+ messages in thread
From: David Miller @ 2013-08-15 20:17 UTC (permalink / raw)
To: nsujir; +Cc: netdev, dborkman, shangw, mchan
From: "Nithin Nayak Sujir" <nsujir@broadcom.com>
Date: Thu, 15 Aug 2013 10:32:58 -0700
> Sorry, I forgot to add Michael's Signed-off-by. Do you want me to
> resend it with his Signed-off-by added?
That's not necessary, it gets added automatically by patchwork
since he replied and added it.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset
2013-08-15 15:15 ` Michael Chan
@ 2013-08-15 20:41 ` David Miller
0 siblings, 0 replies; 7+ messages in thread
From: David Miller @ 2013-08-15 20:41 UTC (permalink / raw)
To: mchan; +Cc: nsujir, netdev, dborkman, shangw
From: "Michael Chan" <mchan@broadcom.com>
Date: Thu, 15 Aug 2013 08:15:20 -0700
> On Thu, 2013-08-15 at 01:07 -0700, David Miller wrote:
>> From: "Nithin Nayak Sujir" <nsujir@broadcom.com>
>> Date: Tue, 13 Aug 2013 11:45:13 -0700
>>
>> > From: Daniel Borkmann <dborkman@redhat.com>
>> >
>> > Commit d8af4dfd8 ("net/tg3: Fix kernel crash") introduced a possible
>> > NULL pointer dereference in tg3 driver when !netdev || !netif_running(netdev)
>> > condition is met and netdev is NULL. Then, the jump to the 'done' label
>> > calls dev_close() with a netdevice that is NULL. Therefore, only call
>> > dev_close() when we have a netdevice, but one that is not running.
>> >
>> > [ Add the same checks in tg3_io_slot_reset() per Gavin Shan - by Nithin
>> > Nayak Sujir ]
>> >
>> > Reported-by: Dave Jones <davej@redhat.com>
>> > Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
>> > Cc: Gavin Shan <shangw@linux.vnet.ibm.com>
>> > Cc: Michael Chan <mchan@broadcom.com>
>> > Signed-off-by: Nithin Nayak Sujir <nsujir@broadcom.com>
>>
>> Can I get some reviews from the Broadcom folks?
>>
>
> We worked with Daniel at Red Hat and Gavin at IBM on this patch.
> Thanks.
>
> Signed-off-by: Michael Chan <mchan@broadcom.com>
Thanks for the info, applied.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2013-08-15 20:41 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-08-13 18:45 [PATCH net] net: tg3: fix NULL pointer dereference in tg3_io_error_detected and tg3_io_slot_reset Nithin Nayak Sujir
2013-08-15 8:07 ` David Miller
2013-08-15 10:57 ` Dmitry Kravkov
2013-08-15 15:15 ` Michael Chan
2013-08-15 20:41 ` David Miller
2013-08-15 17:32 ` Nithin Nayak Sujir
2013-08-15 20:17 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.