netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH net v2 0/3] ibmvnic: null pointer dereference
@ 2020-11-23 19:35 Lijun Pan
  2020-11-23 19:35 ` [PATCH net v2 1/3] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues Lijun Pan
                   ` (3 more replies)
  0 siblings, 4 replies; 5+ messages in thread
From: Lijun Pan @ 2020-11-23 19:35 UTC (permalink / raw)
  To: netdev; +Cc: sukadev, drt, Lijun Pan

Fix two NULL pointer dereference crash issues.
Improve module removal procedure.

In v2, we split v1 into 3 sets according to patch dependencies so that
individual author can rework on them during the coming holiday.
1-11 as a set since they are dependent and most of them are Dany's.
12-14 as a set since they are independent of 1-11.
15 to be sent to net-next.

This series come from 12/15 13/15 14/15 of v1's "ibmvnic: assorted bug
fixes".

Lijun Pan (3):
  ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues
  ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
  ibmvnic: enhance resetting status check during module exit

 drivers/net/ethernet/ibm/ibmvnic.c | 9 +++++++--
 drivers/net/ethernet/ibm/ibmvnic.h | 3 +--
 2 files changed, 8 insertions(+), 4 deletions(-)

-- 
2.23.0


^ permalink raw reply	[flat|nested] 5+ messages in thread
* [PATCH net v2 1/3] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues
  2020-11-23 19:35 [PATCH net v2 0/3] ibmvnic: null pointer dereference Lijun Pan
@ 2020-11-23 19:35 ` Lijun Pan
  2020-11-23 19:35 ` [PATCH net v2 2/3] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq Lijun Pan
                   ` (2 subsequent siblings)
  3 siblings, 0 replies; 5+ messages in thread
From: Lijun Pan @ 2020-11-23 19:35 UTC (permalink / raw)
  To: netdev; +Cc: sukadev, drt, Lijun Pan

adapter->tx_scrq and adapter->rx_scrq could be NULL if the previous reset
did not complete after freeing sub crqs. Check for NULL before
dereferencing them.

Snippet of call trace:
ibmvnic 30000006 env6: Releasing sub-CRQ
ibmvnic 30000006 env6: Releasing CRQ
...
ibmvnic 30000006 env6: Got Control IP offload Response
ibmvnic 30000006 env6: Re-setting tx_scrq[0]
BUG: Kernel NULL pointer dereference on read at 0x00000000
Faulting instruction address: 0xc008000003dea7cc
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in: rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag raw_diag inet_diag unix_diag af_packet_diag netlink_diag tun bridge stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmvnic ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod
CPU: 80 PID: 1856 Comm: kworker/80:2 Tainted: G        W         5.8.0+ #4
Workqueue: events __ibmvnic_reset [ibmvnic]
NIP:  c008000003dea7cc LR: c008000003dea7bc CTR: 0000000000000000
REGS: c0000007ef7db860 TRAP: 0380   Tainted: G        W          (5.8.0+)
MSR:  800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 28002422  XER: 0000000d
CFAR: c000000000bd9520 IRQMASK: 0
GPR00: c008000003dea7bc c0000007ef7dbaf0 c008000003df7400 c0000007fa26ec00
GPR04: c0000007fcd0d008 c0000007fcd96350 0000000000000027 c0000007fcd0d010
GPR08: 0000000000000023 0000000000000000 0000000000000000 0000000000000000
GPR12: 0000000000002000 c00000001ec18e00 c0000000001982f8 c0000007bad6e840
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 fffffffffffffef7
GPR24: 0000000000000402 c0000007fa26f3a8 0000000000000003 c00000016f8ec048
GPR28: 0000000000000000 0000000000000000 0000000000000000 c0000007fa26ec00
NIP [c008000003dea7cc] ibmvnic_reset_init+0x15c/0x258 [ibmvnic]
LR [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic]
Call Trace:
[c0000007ef7dbaf0] [c008000003dea7bc] ibmvnic_reset_init+0x14c/0x258 [ibmvnic] (unreliable)
[c0000007ef7dbb80] [c008000003de8860] __ibmvnic_reset+0x408/0x970 [ibmvnic]
[c0000007ef7dbc50] [c00000000018b7cc] process_one_work+0x2cc/0x800
[c0000007ef7dbd20] [c00000000018bd78] worker_thread+0x78/0x520
[c0000007ef7dbdb0] [c0000000001984c4] kthread+0x1d4/0x1e0
[c0000007ef7dbe20] [c00000000000cea8] ret_from_kernel_thread+0x5c/0x74

Fixes: 57a49436f4e8 ("ibmvnic: Reset sub-crqs during driver reset")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
---
v2: add fix tag
    remove verbose printout, return silently.
    reset function itself will handle the error return    
    
 drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 47446e5f8ec5..5f4fdd13184a 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -2930,6 +2930,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter)
 {
 	int i, rc;
 
+	if (!adapter->tx_scrq || !adapter->rx_scrq)
+		return -EINVAL;
+
 	for (i = 0; i < adapter->req_tx_queues; i++) {
 		netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i);
 		rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]);
-- 
2.23.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
* [PATCH net v2 2/3] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
  2020-11-23 19:35 [PATCH net v2 0/3] ibmvnic: null pointer dereference Lijun Pan
  2020-11-23 19:35 ` [PATCH net v2 1/3] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues Lijun Pan
@ 2020-11-23 19:35 ` Lijun Pan
  2020-11-23 19:35 ` [PATCH net v2 3/3] ibmvnic: enhance resetting status check during module exit Lijun Pan
  2020-11-25  0:40 ` [PATCH net v2 0/3] ibmvnic: null pointer dereference patchwork-bot+netdevbpf
  3 siblings, 0 replies; 5+ messages in thread
From: Lijun Pan @ 2020-11-23 19:35 UTC (permalink / raw)
  To: netdev; +Cc: sukadev, drt, Lijun Pan

crq->msgs could be NULL if the previous reset did not complete after
freeing crq->msgs. Check for NULL before dereferencing them.

Snippet of call trace:
...
ibmvnic 30000003 env3 (unregistering): Releasing sub-CRQ
ibmvnic 30000003 env3 (unregistering): Releasing CRQ
BUG: Kernel NULL pointer dereference on read at 0x00000000
Faulting instruction address: 0xc0000000000c1a30
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in: ibmvnic(E-) rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag tun raw_diag inet_diag unix_diag bridge af_packet_diag netlink_diag stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ibmvnic]
CPU: 20 PID: 8426 Comm: kworker/20:0 Tainted: G            E     5.10.0-rc1+ #12
Workqueue: events __ibmvnic_reset [ibmvnic]
NIP:  c0000000000c1a30 LR: c008000001b00c18 CTR: 0000000000000400
REGS: c00000000d05b7a0 TRAP: 0380   Tainted: G            E      (5.10.0-rc1+)
MSR:  800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  CR: 44002480  XER: 20040000
CFAR: c0000000000c19ec IRQMASK: 0
GPR00: 0000000000000400 c00000000d05ba30 c008000001b17c00 0000000000000000
GPR04: 0000000000000000 0000000000000000 0000000000000000 00000000000001e2
GPR08: 000000000001f400 ffffffffffffd950 0000000000000000 c008000001b0b280
GPR12: c0000000000c19c8 c00000001ec72e00 c00000000019a778 c00000002647b440
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000006 0000000000000001 0000000000000003 0000000000000002
GPR24: 0000000000001000 c008000001b0d570 0000000000000005 c00000007ab5d550
GPR28: c00000007ab5c000 c000000032fcf848 c00000007ab5cc00 c000000032fcf800
NIP [c0000000000c1a30] memset+0x68/0x104
LR [c008000001b00c18] ibmvnic_reset_crq+0x70/0x110 [ibmvnic]
Call Trace:
[c00000000d05ba30] [0000000000000800] 0x800 (unreliable)
[c00000000d05bab0] [c008000001b0a930] do_reset.isra.40+0x224/0x634 [ibmvnic]
[c00000000d05bb80] [c008000001b08574] __ibmvnic_reset+0x17c/0x3c0 [ibmvnic]
[c00000000d05bc50] [c00000000018d9ac] process_one_work+0x2cc/0x800
[c00000000d05bd20] [c00000000018df58] worker_thread+0x78/0x520
[c00000000d05bdb0] [c00000000019a934] kthread+0x1c4/0x1d0
[c00000000d05be20] [c00000000000d5d0] ret_from_kernel_thread+0x5c/0x6c

Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
---
v2: add fix tag.
    remove verbose printout, return silently.
    reset function itself will handle the error return.

 drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 5f4fdd13184a..91b7a383debf 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -5049,6 +5049,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter)
 	} while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
 
 	/* Clean out the queue */
+	if (!crq->msgs)
+		return -EINVAL;
+
 	memset(crq->msgs, 0, PAGE_SIZE);
 	crq->cur = 0;
 	crq->active = false;
-- 
2.23.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
* [PATCH net v2 3/3] ibmvnic: enhance resetting status check during module exit
  2020-11-23 19:35 [PATCH net v2 0/3] ibmvnic: null pointer dereference Lijun Pan
  2020-11-23 19:35 ` [PATCH net v2 1/3] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues Lijun Pan
  2020-11-23 19:35 ` [PATCH net v2 2/3] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq Lijun Pan
@ 2020-11-23 19:35 ` Lijun Pan
  2020-11-25  0:40 ` [PATCH net v2 0/3] ibmvnic: null pointer dereference patchwork-bot+netdevbpf
  3 siblings, 0 replies; 5+ messages in thread
From: Lijun Pan @ 2020-11-23 19:35 UTC (permalink / raw)
  To: netdev; +Cc: sukadev, drt, Lijun Pan

Based on the discussion with Sukadev Bhattiprolu and Dany Madden,
we believe that checking adapter->resetting bit is preferred
since RESETTING state flag is not as strict as resetting bit.
RESETTING state flag is removed since it is verbose now.

Fixes: 7d7195a026ba ("ibmvnic: Do not process device remove during device reset")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
---
v2: add fix tag

 drivers/net/ethernet/ibm/ibmvnic.c | 3 +--
 drivers/net/ethernet/ibm/ibmvnic.h | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 91b7a383debf..5cb4cfabe2de 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -2251,7 +2251,6 @@ static void __ibmvnic_reset(struct work_struct *work)
 
 		if (!saved_state) {
 			reset_state = adapter->state;
-			adapter->state = VNIC_RESETTING;
 			saved_state = true;
 		}
 		spin_unlock_irqrestore(&adapter->state_lock, flags);
@@ -5357,7 +5356,7 @@ static int ibmvnic_remove(struct vio_dev *dev)
 	unsigned long flags;
 
 	spin_lock_irqsave(&adapter->state_lock, flags);
-	if (adapter->state == VNIC_RESETTING) {
+	if (test_bit(0, &adapter->resetting)) {
 		spin_unlock_irqrestore(&adapter->state_lock, flags);
 		return -EBUSY;
 	}
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index d15866cbc2a6..950f439bed32 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -943,8 +943,7 @@ enum vnic_state {VNIC_PROBING = 1,
 		 VNIC_CLOSING,
 		 VNIC_CLOSED,
 		 VNIC_REMOVING,
-		 VNIC_REMOVED,
-		 VNIC_RESETTING};
+		 VNIC_REMOVED};
 
 enum ibmvnic_reset_reason {VNIC_RESET_FAILOVER = 1,
 			   VNIC_RESET_MOBILITY,
-- 
2.23.0


^ permalink raw reply related	[flat|nested] 5+ messages in thread
* Re: [PATCH net v2 0/3] ibmvnic: null pointer dereference
  2020-11-23 19:35 [PATCH net v2 0/3] ibmvnic: null pointer dereference Lijun Pan
                   ` (2 preceding siblings ...)
  2020-11-23 19:35 ` [PATCH net v2 3/3] ibmvnic: enhance resetting status check during module exit Lijun Pan
@ 2020-11-25  0:40 ` patchwork-bot+netdevbpf
  3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2020-11-25  0:40 UTC (permalink / raw)
  To: Lijun Pan; +Cc: netdev, sukadev, drt

Hello:

This series was applied to netdev/net.git (refs/heads/master):

On Mon, 23 Nov 2020 13:35:44 -0600 you wrote:
> Fix two NULL pointer dereference crash issues.
> Improve module removal procedure.
> 
> In v2, we split v1 into 3 sets according to patch dependencies so that
> individual author can rework on them during the coming holiday.
> 1-11 as a set since they are dependent and most of them are Dany's.
> 12-14 as a set since they are independent of 1-11.
> 15 to be sent to net-next.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/3] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues
    https://git.kernel.org/netdev/net/c/a0faaa27c716
  - [net,v2,2/3] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
    https://git.kernel.org/netdev/net/c/0e435befaea4
  - [net,v2,3/3] ibmvnic: enhance resetting status check during module exit
    https://git.kernel.org/netdev/net/c/3ada288150fb

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-11-25  0:40 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-23 19:35 [PATCH net v2 0/3] ibmvnic: null pointer dereference Lijun Pan
2020-11-23 19:35 ` [PATCH net v2 1/3] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues Lijun Pan
2020-11-23 19:35 ` [PATCH net v2 2/3] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq Lijun Pan
2020-11-23 19:35 ` [PATCH net v2 3/3] ibmvnic: enhance resetting status check during module exit Lijun Pan
2020-11-25  0:40 ` [PATCH net v2 0/3] ibmvnic: null pointer dereference patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).