From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Lijun Pan <ljp@linux.ibm.com>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 36/50] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues
Date: Tue, 1 Dec 2020 09:53:35 +0100 [thread overview]
Message-ID: <20201201084649.483905706@linuxfoundation.org> (raw)
In-Reply-To: <20201201084644.803812112@linuxfoundation.org>
From: Lijun Pan <ljp@linux.ibm.com>
[ Upstream commit a0faaa27c71608799e0dd765c5af38a089091802 ]
adapter->tx_scrq and adapter->rx_scrq could be NULL if the previous reset
did not complete after freeing sub crqs. Check for NULL before
dereferencing them.
Snippet of call trace:
ibmvnic 30000006 env6: Releasing sub-CRQ
ibmvnic 30000006 env6: Releasing CRQ
...
ibmvnic 30000006 env6: Got Control IP offload Response
ibmvnic 30000006 env6: Re-setting tx_scrq[0]
BUG: Kernel NULL pointer dereference on read at 0x00000000
Faulting instruction address: 0xc008000003dea7cc
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in: rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag tun bridge stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmvnic ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod
CPU: 80 PID: 1856 Comm: kworker/80:2 Tainted: G W 5.8.0+ #4
Workqueue: events __ibmvnic_reset [ibmvnic]
NIP: c008000003dea7cc LR: c008000003dea7bc CTR: 0000000000000000
REGS: c0000007ef7db860 TRAP: 0380 Tainted: G W (5.8.0+)
MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 28002422 XER: 0000000d
CFAR: c000000000bd9520 IRQMASK: 0
GPR00: c008000003dea7bc c0000007ef7dbaf0 c008000003df7400 c0000007fa26ec00
GPR04: c0000007fcd0d008 c0000007fcd96350 0000000000000027 c0000007fcd0d010
GPR08: 0000000000000023 0000000000000000 0000000000000000 0000000000000000
GPR12: 0000000000002000 c00000001ec18e00 c0000000001982f8 c0000007bad6e840
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 fffffffffffffef7
GPR24: 0000000000000402 c0000007fa26f3a8 0000000000000003 c00000016f8ec048
GPR28: 0000000000000000 0000000000000000 0000000000000000 c0000007fa26ec00
NIP [c008000003dea7cc] ibmvnic_reset_init+0x15c/0x258 [ibmvnic]
LR [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic]
Call Trace:
[c0000007ef7dbaf0] [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic] (unreliable)
[c0000007ef7dbb80] [c008000003de8860] __ibmvnic_reset+0x408/0x970 [ibmvnic]
[c0000007ef7dbc50] [c00000000018b7cc] process_one_work+0x2cc/0x800
[c0000007ef7dbd20] [c00000000018bd78] worker_thread+0x78/0x520
[c0000007ef7dbdb0] [c0000000001984c4] kthread+0x1d4/0x1e0
[c0000007ef7dbe20] [c00000000000cea8] ret_from_kernel_thread+0x5c/0x74
Fixes: 57a49436f4e8 ("ibmvnic: Reset sub-crqs during driver reset")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 8b8a0c4fbc993..3f2816af7b250 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1977,6 +1977,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter)
{
int i, rc;
+ if (!adapter->tx_scrq || !adapter->rx_scrq)
+ return -EINVAL;
+
for (i = 0; i < adapter->req_tx_queues; i++) {
netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i);
rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]);
--
2.27.0
next prev parent reply other threads:[~2020-12-01 8:59 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-01 8:52 [PATCH 4.14 00/50] 4.14.210-rc1 review Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 01/50] perf event: Check ref_reloc_sym before using it Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 02/50] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 03/50] btrfs: fix lockdep splat when reading qgroup config on mount Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 04/50] wireless: Use linux/stddef.h instead of stddef.h Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 05/50] PCI: Add device even if driver attach failed Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 06/50] btrfs: tree-checker: Enhance chunk checker to validate chunk profile Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 07/50] btrfs: adjust return values of btrfs_inode_by_name Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 08/50] btrfs: inode: Verify inode mode to avoid NULL pointer dereference Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 09/50] KVM: x86: Fix split-irqchip vs interrupt injection window request Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 10/50] arm64: pgtable: Fix pte_accessible() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 11/50] arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 12/50] ALSA: hda/hdmi: Use single mutex unlock in error paths Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 13/50] ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 14/50] HID: cypress: Support Varmilo Keyboards media hotkeys Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 15/50] Input: i8042 - allow insmod to succeed on devices without an i8042 controller Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 16/50] HID: hid-sensor-hub: Fix issue with devices with no report ID Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 17/50] dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 18/50] x86/xen: dont unbind uninitialized lock_kicker_irq Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 19/50] HID: Add Logitech Dinovo Edge battery quirk Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 20/50] proc: dont allow async path resolution of /proc/self components Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 21/50] nvme: free sq/cq dbbuf pointers when dbbuf set fails Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 22/50] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 23/50] scsi: libiscsi: Fix NOP race condition Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 24/50] scsi: target: iscsi: Fix cmd abort fabric stop race Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 25/50] perf/x86: fix sysfs type mismatches Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 26/50] phy: tegra: xusb: Fix dangling pointer on probe failure Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 27/50] batman-adv: set .owner to THIS_MODULE Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 28/50] scsi: ufs: Fix race between shutdown and runtime resume flow Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 29/50] bnxt_en: fix error return code in bnxt_init_one() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 30/50] bnxt_en: fix error return code in bnxt_init_board() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 31/50] video: hyperv_fb: Fix the cache type when mapping the VRAM Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 32/50] bnxt_en: Release PCI regions when DMA mask setup fails during probe Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 33/50] IB/mthca: fix return value of error branch in mthca_init_cq() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 34/50] nfc: s3fwrn5: use signed integer for parsing GPIO numbers Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 35/50] net: ena: set initial DMA width to avoid intel iommu issue Greg Kroah-Hartman
2020-12-01 8:53 ` Greg Kroah-Hartman [this message]
2020-12-01 8:53 ` [PATCH 4.14 37/50] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 38/50] efivarfs: revert "fix memory leak in efivarfs_create()" Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 39/50] can: gs_usb: fix endianess problem with candleLight firmware Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 40/50] platform/x86: toshiba_acpi: Fix the wrong variable assignment Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 41/50] can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 42/50] perf probe: Fix to die_entrypc() returns error correctly Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 43/50] USB: core: Change %pK for __user pointers to %px Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 44/50] usb: gadget: f_midi: Fix memleak in f_midi_alloc Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 45/50] usb: gadget: Fix memleak in gadgetfs_fill_super Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 46/50] x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 47/50] x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 48/50] x86/resctrl: Add necessary kernfs_put() " Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 49/50] USB: core: add endpoint-blacklist quirk Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 4.14 50/50] USB: core: Fix regression in Hercules audio card Greg Kroah-Hartman
2020-12-01 21:39 ` [PATCH 4.14 00/50] 4.14.210-rc1 review Guenter Roeck
2020-12-02 6:04 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201201084649.483905706@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ljp@linux.ibm.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).