netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/1] be2net: Detach interface for avoiding a system crash
@ 2019-04-01 12:24 Firo Yang
  2019-04-01 16:25 ` Saeed Mahameed
  2019-04-08  9:10 ` [be2net] b36ed347bf: INFO:rcu_tasks_detected_stalls_on_tasks kernel test robot
  0 siblings, 2 replies; 10+ messages in thread
From: Firo Yang @ 2019-04-01 12:24 UTC (permalink / raw)
  To: sathya.perla, ajit.khaparde, sriharsha.basavapatna, somnath.kotur, davem
  Cc: netdev, firogm, Firo Yang

This crash is triggered by a user-after-free since lake of
the synchronization of a race condition between 
be_update_queues() modifying multi-purpose channels of
network device and be_tx_timeout().

BUG: unable to handle kernel NULL pointer dereference at (null)
Call Trace:
be_tx_timeout+0xa5/0x360 [be2net]
dev_watchdog+0x1d8/0x210
call_timer_fn+0x32/0x140

To fix it, detach the interface before modifying
multi-purpose channels of network device.

Signed-off-by: Firo Yang <fyang@suse.com>
---
 drivers/net/ethernet/emulex/benet/be_main.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index d5026909dec5..25d0128bf684 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4705,6 +4705,8 @@ int be_update_queues(struct be_adapter *adapter)
 	struct net_device *netdev = adapter->netdev;
 	int status;
 
+	netif_device_detach(netdev);
+
 	if (netif_running(netdev))
 		be_close(netdev);
 
@@ -4719,21 +4721,21 @@ int be_update_queues(struct be_adapter *adapter)
 	be_clear_queues(adapter);
 	status = be_cmd_if_destroy(adapter, adapter->if_handle,  0);
 	if (status)
-		return status;
+		goto out;
 
 	if (!msix_enabled(adapter)) {
 		status = be_msix_enable(adapter);
 		if (status)
-			return status;
+			goto out;
 	}
 
 	status = be_if_create(adapter);
 	if (status)
-		return status;
+		goto out;
 
 	status = be_setup_queues(adapter);
 	if (status)
-		return status;
+		goto out;
 
 	be_schedule_worker(adapter);
 
@@ -4748,6 +4750,8 @@ int be_update_queues(struct be_adapter *adapter)
 	if (netif_running(netdev))
 		status = be_open(netdev);
 
+out:
+	netif_device_attach(netdev);
 	return status;
 }
 
-- 
2.16.4


^ permalink raw reply related	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2019-04-25 20:35 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-01 12:24 [PATCH 1/1] be2net: Detach interface for avoiding a system crash Firo Yang
2019-04-01 16:25 ` Saeed Mahameed
2019-04-02  8:32   ` Firo
2019-04-18  7:05   ` Firo
2019-04-18 18:17     ` Saeed Mahameed
2019-04-19 13:07       ` Firo
2019-04-19 22:31         ` Saeed Mahameed
2019-04-24  5:53           ` Firo
2019-04-25 20:35             ` Saeed Mahameed
2019-04-08  9:10 ` [be2net] b36ed347bf: INFO:rcu_tasks_detected_stalls_on_tasks kernel test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).