From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tong Zhang <ztong0001@gmail.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
linux-atm-general@lists.sourceforge.net, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 06/54] atm: lanai: dont run lanai_dev_close if not open
Date: Tue, 16 Mar 2021 20:56:05 -0400 [thread overview]
Message-ID: <20210317005654.724862-6-sashal@kernel.org> (raw)
In-Reply-To: <20210317005654.724862-1-sashal@kernel.org>
From: Tong Zhang <ztong0001@gmail.com>
[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ]
lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the
pci device is disabled. The caller, lanai_init_one(), then tries to run
atm_dev_deregister(). This will subsequently call lanai_dev_close() and
use the already released MMIO area.
To fix this issue, set the lanai->base to NULL if open fail,
and test the flag in lanai_dev_close().
[ 8.324153] lanai: lanai_start() failed, err=19
[ 8.324819] lanai(itf 0): shutting down interface
[ 8.325211] BUG: unable to handle page fault for address: ffffc90000180024
[ 8.325781] #PF: supervisor write access in kernel mode
[ 8.326215] #PF: error_code(0x0002) - not-present page
[ 8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0
[ 8.327206] Oops: 0002 [#1] SMP KASAN NOPTI
[ 8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12
[ 8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4
[ 8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
[ 8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
[ 8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
[ 8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
[ 8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
[ 8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
[ 8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
[ 8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
[ 8.333077] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
[ 8.333502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
[ 8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.334932] Call Trace:
[ 8.335066] atm_dev_deregister+0x161/0x1a0 [atm]
[ 8.335324] lanai_init_one.cold+0x20c/0x96d [lanai]
[ 8.335594] ? lanai_send+0x2a0/0x2a0 [lanai]
[ 8.335831] local_pci_probe+0x6f/0xb0
[ 8.336039] pci_device_probe+0x171/0x240
[ 8.336255] ? pci_device_remove+0xe0/0xe0
[ 8.336475] ? kernfs_create_link+0xb6/0x110
[ 8.336704] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
[ 8.336983] really_probe+0x161/0x420
[ 8.337181] driver_probe_device+0x6d/0xd0
[ 8.337401] device_driver_attach+0x82/0x90
[ 8.337626] ? device_driver_attach+0x90/0x90
[ 8.337859] __driver_attach+0x60/0x100
[ 8.338065] ? device_driver_attach+0x90/0x90
[ 8.338298] bus_for_each_dev+0xe1/0x140
[ 8.338511] ? subsys_dev_iter_exit+0x10/0x10
[ 8.338745] ? klist_node_init+0x61/0x80
[ 8.338956] bus_add_driver+0x254/0x2a0
[ 8.339164] driver_register+0xd3/0x150
[ 8.339370] ? 0xffffffffc0028000
[ 8.339550] do_one_initcall+0x84/0x250
[ 8.339755] ? trace_event_raw_event_initcall_finish+0x150/0x150
[ 8.340076] ? free_vmap_area_noflush+0x1a5/0x5c0
[ 8.340329] ? unpoison_range+0xf/0x30
[ 8.340532] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[ 8.340806] ? unpoison_range+0xf/0x30
[ 8.341014] ? unpoison_range+0xf/0x30
[ 8.341217] do_init_module+0xf8/0x350
[ 8.341419] load_module+0x3fe6/0x4340
[ 8.341621] ? vm_unmap_ram+0x1d0/0x1d0
[ 8.341826] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[ 8.342101] ? module_frob_arch_sections+0x20/0x20
[ 8.342358] ? __do_sys_finit_module+0x108/0x170
[ 8.342604] __do_sys_finit_module+0x108/0x170
[ 8.342841] ? __ia32_sys_init_module+0x40/0x40
[ 8.343083] ? file_open_root+0x200/0x200
[ 8.343298] ? do_sys_open+0x85/0xe0
[ 8.343491] ? filp_open+0x50/0x50
[ 8.343675] ? exit_to_user_mode_prepare+0xfc/0x130
[ 8.343935] do_syscall_64+0x33/0x40
[ 8.344132] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 8.344401] RIP: 0033:0x7f08eb887cf7
[ 8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41
[ 8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7
[ 8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003
[ 8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
[ 8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0
[ 8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001
[ 8.347836] Modules linked in: lanai(+) atm
[ 8.348065] CR2: ffffc90000180024
[ 8.348244] ---[ end trace 7fdc1c668f2003e5 ]---
[ 8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
[ 8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
[ 8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
[ 8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
[ 8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
[ 8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
[ 8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
[ 8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
[ 8.351918] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
[ 8.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
[ 8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.353958] modprobe (95) used greatest stack depth: 26216 bytes left
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/lanai.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index ac811cfa6843..92edd100a394 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -2234,6 +2234,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
conf1_write(lanai);
#endif
iounmap(lanai->base);
+ lanai->base = NULL;
error_pci:
pci_disable_device(lanai->pci);
error:
@@ -2246,6 +2247,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)
static void lanai_dev_close(struct atm_dev *atmdev)
{
struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data;
+ if (lanai->base==NULL)
+ return;
printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n",
lanai->number);
lanai_timed_poll_stop(lanai);
@@ -2553,7 +2556,7 @@ static int lanai_init_one(struct pci_dev *pci,
struct atm_dev *atmdev;
int result;
- lanai = kmalloc(sizeof(*lanai), GFP_KERNEL);
+ lanai = kzalloc(sizeof(*lanai), GFP_KERNEL);
if (lanai == NULL) {
printk(KERN_ERR DEV_LABEL
": couldn't allocate dev_data structure!\n");
--
2.30.1
next prev parent reply other threads:[~2021-03-17 0:59 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-17 0:56 [PATCH AUTOSEL 5.10 01/54] mt76: fix tx skb error handling in mt76_dma_tx_queue_skb Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 02/54] net: stmmac: fix dma physical address of descriptor when display ring Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 03/54] net: fec: ptp: avoid register access when ipg clock is disabled Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 04/54] powerpc/4xx: Fix build errors from mfdcr() Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 05/54] atm: eni: dont release is never initialized Sasha Levin
2021-03-17 0:56 ` Sasha Levin [this message]
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 07/54] Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 08/54] ALSA: hda: ignore invalid NHLT table Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 09/54] ixgbe: Fix memleak in ixgbe_configure_clsu32 Sasha Levin
2021-03-17 0:56 ` [Intel-wired-lan] " Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 10/54] scsi: ufs: ufs-qcom: Disable interrupt in reset path Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 11/54] blk-cgroup: Fix the recursive blkg rwstat Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 12/54] net: tehuti: fix error return code in bdx_probe() Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 13/54] net: intel: iavf: fix error return code of iavf_init_get_resources() Sasha Levin
2021-03-17 0:56 ` [Intel-wired-lan] " Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 14/54] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 15/54] gianfar: fix jumbo packets+napi+rx overrun crash Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 16/54] cifs: ask for more credit on async read/write code paths Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 17/54] gfs2: fix use-after-free in trans_drain Sasha Levin
2021-03-17 0:56 ` [Cluster-devel] " Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 18/54] cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 19/54] gpiolib: acpi: Add missing IRQF_ONESHOT Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 20/54] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 21/54] NFS: Correct size calculation for create reply length Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 22/54] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 23/54] net: wan: fix error return code of uhdlc_init() Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 24/54] net: davicom: Use platform_get_irq_optional() Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 25/54] net: enetc: set MAC RX FIFO to recommended value Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 26/54] atm: uPD98402: fix incorrect allocation Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 27/54] atm: idt77252: fix null-ptr-dereference Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 28/54] cifs: change noisy error message to FYI Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 29/54] irqchip/ingenic: Add support for the JZ4760 Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 30/54] kbuild: add image_name to no-sync-config-targets Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 31/54] kbuild: dummy-tools: fix inverted tests for gcc Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 32/54] umem: fix error return code in mm_pci_probe() Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 33/54] sparc64: Fix opcode filtering in handling of no fault loads Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 34/54] habanalabs: Call put_pid() when releasing control device Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 35/54] staging: rtl8192e: fix kconfig dependency on CRYPTO Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 36/54] u64_stats,lockdep: Fix u64_stats_init() vs lockdep Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 37/54] kselftest: arm64: Fix exit code of sve-ptrace Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 38/54] regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 39/54] block: Fix REQ_OP_ZONE_RESET_ALL handling Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 40/54] drm/amd/display: Revert dram_clock_change_latency for DCN2.1 Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 41/54] drm/amdgpu: fb BO should be ttm_bo_type_device Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 42/54] drm/radeon: fix AGP dependency Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 43/54] nvme: simplify error logic in nvme_validate_ns() Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 44/54] nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 45/54] nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 46/54] nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 47/54] nvme-core: check ctrl css before setting up zns Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 48/54] nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 49/54] nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 50/54] nfs: we don't support removing system.nfs4_acl Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 51/54] block: Suppress uevent for hidden device when removed Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 52/54] mm/fork: clear PASID for new mm Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 53/54] ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls Sasha Levin
2021-03-17 0:56 ` Sasha Levin
2021-03-17 0:56 ` [PATCH AUTOSEL 5.10 54/54] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign Sasha Levin
2021-03-17 0:56 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210317005654.724862-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=linux-atm-general@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=ztong0001@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.