From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Lorenzo Bianconi <lorenzo.bianconi@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.4 27/88] net: thunderx: fix NULL pointer dereference in nic_remove
Date: Fri, 14 Dec 2018 13:00:01 +0100 [thread overview]
Message-ID: <20181214115704.318348301@linuxfoundation.org> (raw)
In-Reply-To: <20181214115702.151309521@linuxfoundation.org>
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 24a6d2dd263bc910de018c78d1148b3e33b94512 ]
Fix a possible NULL pointer dereference in nic_remove routine
removing the nicpf module if nic_probe fails.
The issue can be triggered with the following reproducer:
$rmmod nicvf
$rmmod nicpf
[ 521.412008] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000014
[ 521.422777] Mem abort info:
[ 521.425561] ESR = 0x96000004
[ 521.428624] Exception class = DABT (current EL), IL = 32 bits
[ 521.434535] SET = 0, FnV = 0
[ 521.437579] EA = 0, S1PTW = 0
[ 521.440730] Data abort info:
[ 521.443603] ISV = 0, ISS = 0x00000004
[ 521.447431] CM = 0, WnR = 0
[ 521.450417] user pgtable: 4k pages, 48-bit VAs, pgdp = 0000000072a3da42
[ 521.457022] [0000000000000014] pgd=0000000000000000
[ 521.461916] Internal error: Oops: 96000004 [#1] SMP
[ 521.511801] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018
[ 521.518664] pstate: 80400005 (Nzcv daif +PAN -UAO)
[ 521.523451] pc : nic_remove+0x24/0x88 [nicpf]
[ 521.527808] lr : pci_device_remove+0x48/0xd8
[ 521.532066] sp : ffff000013433cc0
[ 521.535370] x29: ffff000013433cc0 x28: ffff810f6ac50000
[ 521.540672] x27: 0000000000000000 x26: 0000000000000000
[ 521.545974] x25: 0000000056000000 x24: 0000000000000015
[ 521.551274] x23: ffff8007ff89a110 x22: ffff000001667070
[ 521.556576] x21: ffff8007ffb170b0 x20: ffff8007ffb17000
[ 521.561877] x19: 0000000000000000 x18: 0000000000000025
[ 521.567178] x17: 0000000000000000 x16: 000000000000010ffc33ff98 x8 : 0000000000000000
[ 521.593683] x7 : 0000000000000000 x6 : 0000000000000001
[ 521.598983] x5 : 0000000000000002 x4 : 0000000000000003
[ 521.604284] x3 : ffff8007ffb17184 x2 : ffff8007ffb17184
[ 521.609585] x1 : ffff000001662118 x0 : ffff000008557be0
[ 521.614887] Process rmmod (pid: 1897, stack limit = 0x00000000859535c3)
[ 521.621490] Call trace:
[ 521.623928] nic_remove+0x24/0x88 [nicpf]
[ 521.627927] pci_device_remove+0x48/0xd8
[ 521.631847] device_release_driver_internal+0x1b0/0x248
[ 521.637062] driver_detach+0x50/0xc0
[ 521.640628] bus_remove_driver+0x60/0x100
[ 521.644627] driver_unregister+0x34/0x60
[ 521.648538] pci_unregister_driver+0x24/0xd8
[ 521.652798] nic_cleanup_module+0x14/0x111c [nicpf]
[ 521.657672] __arm64_sys_delete_module+0x150/0x218
[ 521.662460] el0_svc_handler+0x94/0x110
[ 521.666287] el0_svc+0x8/0xc
[ 521.669160] Code: aa1e03e0 9102c295 d503201f f9404eb3 (b9401660)
Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nic_main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 16baaafed26c..cbdeb54eab51 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -1090,6 +1090,9 @@ static void nic_remove(struct pci_dev *pdev)
{
struct nicpf *nic = pci_get_drvdata(pdev);
+ if (!nic)
+ return;
+
if (nic->flags & NIC_SRIOV_ENABLED)
pci_disable_sriov(pdev);
--
2.19.1
next prev parent reply other threads:[~2018-12-14 12:14 UTC|newest]
Thread overview: 105+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-14 11:59 [PATCH 4.4 00/88] 4.4.168-stable review Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 01/88] ipv6: Check available headroom in ip6_xmit() even without options Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 02/88] net: 8139cp: fix a BUG triggered by changing mtu with network traffic Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 03/88] net: phy: dont allow __set_phy_supported to add unsupported modes Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 04/88] net: Prevent invalid access to skb->prev in __qdisc_drop_all Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 05/88] rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 06/88] tcp: fix NULL ref in tail loss probe Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 07/88] tun: forbid iface creation with rtnl ops Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 08/88] neighbour: Avoid writing before skb->head in neigh_hh_output() Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 09/88] ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes Greg Kroah-Hartman
2018-12-16 9:57 ` jwiesner
2018-12-14 11:59 ` [PATCH 4.4 10/88] ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 11/88] ARM: OMAP1: ams-delta: Fix possible use of uninitialized field Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 12/88] sysv: return err instead of 0 in __sysv_write_inode Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 13/88] s390/cpum_cf: Reject request for sampling in event initialization Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 14/88] hwmon: (ina2xx) Fix current value calculation Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 15/88] ASoC: dapm: Recalculate audio map forcely when card instantiated Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 16/88] hwmon: (w83795) temp4_type has writable permission Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 17/88] Btrfs: send, fix infinite loop due to directory rename dependencies Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 18/88] ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 19/88] ASoC: omap-dmic: Add pm_qos handling to avoid overruns " Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 20/88] exportfs: do not read dentry after free Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 21/88] bpf: fix check of allowed specifiers in bpf_trace_printk Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 22/88] USB: omap_udc: use devm_request_irq() Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 23/88] USB: omap_udc: fix crashes on probe error and module removal Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 24/88] USB: omap_udc: fix omap_udc_start() on 15xx machines Greg Kroah-Hartman
2018-12-14 11:59 ` [PATCH 4.4 25/88] USB: omap_udc: fix USB gadget functionality on Palm Tungsten E Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 26/88] KVM: x86: fix empty-body warnings Greg Kroah-Hartman
2018-12-14 12:00 ` Greg Kroah-Hartman [this message]
2018-12-14 12:00 ` [PATCH 4.4 28/88] ixgbe: recognize 1000BaseLX SFP modules as 1Gbps Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 29/88] net: hisilicon: remove unexpected free_netdev Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 30/88] drm/ast: fixed reading monitor EDID not stable issue Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 31/88] xen: xlate_mmu: add missing header to fix W=1 warning Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 32/88] fscache: fix race between enablement and dropping of object Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 33/88] fscache, cachefiles: remove redundant variable cache Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 34/88] ocfs2: fix deadlock caused by ocfs2_defrag_extent() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 35/88] hfs: do not free node before using Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 36/88] hfsplus: " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 37/88] debugobjects: avoid recursive calls with kmemleak Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 38/88] ocfs2: fix potential use after free Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 39/88] pstore: Convert console write to use ->write_buf Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 40/88] ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 41/88] KVM: nVMX: fix msr bitmaps to prevent L2 from accessing L0 x2APIC Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 42/88] KVM: nVMX: mark vmcs12 pages dirty on L2 exit Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 43/88] KVM: nVMX: Eliminate vmcs02 pool Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 44/88] KVM: VMX: introduce alloc_loaded_vmcs Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 45/88] KVM: VMX: make MSR bitmaps per-VCPU Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 46/88] KVM/x86: Add IBPB support Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 47/88] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 48/88] KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 49/88] KVM/SVM: " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 50/88] KVM/x86: Remove indirect MSR op calls from SPEC_CTRL Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 51/88] x86: reorganize SMAP handling in user space accesses Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 52/88] x86: fix SMAP in 32-bit environments Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 53/88] x86: Introduce __uaccess_begin_nospec() and uaccess_try_nospec Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 54/88] x86/usercopy: Replace open coded stac/clac with __uaccess_{begin, end} Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 55/88] x86/uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 56/88] x86/bugs, KVM: Support the combination of guest and host IBRS Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 57/88] x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 58/88] KVM: SVM: Move spec control call after restore of GS Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 59/88] x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 60/88] x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 61/88] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 62/88] bpf: support 8-byte metafield access Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 63/88] bpf/verifier: Add spi variable to check_stack_write() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 64/88] bpf/verifier: Pass instruction index to check_mem_access() and check_xadd() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 65/88] bpf: Prevent memory disambiguation attack Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 66/88] wil6210: missing length check in wmi_set_ie Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 67/88] posix-timers: Sanitize overrun handling Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 68/88] mm/hugetlb.c: dont call region_abort if region_chg fails Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 69/88] hugetlbfs: fix offset overflow in hugetlbfs mmap Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 70/88] hugetlbfs: check for pgoff value overflow Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 71/88] hugetlbfs: fix bug in pgoff overflow checking Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 72/88] swiotlb: clean up reporting Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 73/88] sr: pass down correctly sized SCSI sense buffer Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 74/88] mm: remove write/force parameters from __get_user_pages_locked() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 75/88] mm: remove write/force parameters from __get_user_pages_unlocked() Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 76/88] mm: replace get_user_pages_unlocked() write/force parameters with gup_flags Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 77/88] mm: replace get_user_pages_locked() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 78/88] mm: replace get_vaddr_frames() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 79/88] mm: replace get_user_pages() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 80/88] mm: replace __access_remote_vm() write parameter " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 81/88] mm: replace access_remote_vm() " Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 82/88] proc: dont use FOLL_FORCE for reading cmdline and environment Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 83/88] proc: do not access cmdline nor environ from file-backed areas Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 84/88] media: dvb-frontends: fix i2c access helpers for KASAN Greg Kroah-Hartman
2018-12-14 12:00 ` [PATCH 4.4 85/88] matroxfb: fix size of memcpy Greg Kroah-Hartman
2018-12-14 12:01 ` [PATCH 4.4 86/88] staging: speakup: Replace strncpy with memcpy Greg Kroah-Hartman
2018-12-14 12:01 ` [PATCH 4.4 87/88] rocker: fix rocker_tlv_put_* functions for KASAN Greg Kroah-Hartman
2018-12-14 12:01 ` [PATCH 4.4 88/88] selftests: Move networking/timestamping from Documentation Greg Kroah-Hartman
2018-12-14 15:39 ` [PATCH 4.4 00/88] 4.4.168-stable review Guenter Roeck
2018-12-14 17:33 ` kernelci.org bot
2018-12-14 20:12 ` shuah
2018-12-15 2:10 ` Guenter Roeck
2018-12-15 8:07 ` Greg Kroah-Hartman
2018-12-15 15:45 ` Guenter Roeck
2018-12-16 23:58 ` Ben Hutchings
2018-12-17 9:05 ` Greg Kroah-Hartman
2018-12-17 13:46 ` Guenter Roeck
2018-12-17 19:08 ` Greg Kroah-Hartman
2018-12-17 20:12 ` Guenter Roeck
2018-12-17 20:52 ` Greg Kroah-Hartman
2018-12-15 11:15 ` Harsh Shandilya
2018-12-17 9:06 ` Greg Kroah-Hartman
2018-12-15 16:44 ` Dan Rue
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181214115704.318348301@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=lorenzo.bianconi@redhat.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).