From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Michal Simek <michal.simek@xilinx.com>,
Guenter Roeck <linux@roeck-us.net>, Jens Axboe <axboe@kernel.dk>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 3.18 44/86] xsysace: Fix error handling in ace_setup
Date: Wed, 15 May 2019 12:55:21 +0200 [thread overview]
Message-ID: <20190515090651.167896292@linuxfoundation.org> (raw)
In-Reply-To: <20190515090642.339346723@linuxfoundation.org>
[ Upstream commit 47b16820c490149c2923e8474048f2c6e7557cab ]
If xace hardware reports a bad version number, the error handling code
in ace_setup() calls put_disk(), followed by queue cleanup. However, since
the disk data structure has the queue pointer set, put_disk() also
cleans and releases the queue. This results in blk_cleanup_queue()
accessing an already released data structure, which in turn may result
in a crash such as the following.
[ 10.681671] BUG: Kernel NULL pointer dereference at 0x00000040
[ 10.681826] Faulting instruction address: 0xc0431480
[ 10.682072] Oops: Kernel access of bad area, sig: 11 [#1]
[ 10.682251] BE PAGE_SIZE=4K PREEMPT Xilinx Virtex440
[ 10.682387] Modules linked in:
[ 10.682528] CPU: 0 PID: 1 Comm: swapper Tainted: G W 5.0.0-rc6-next-20190218+ #2
[ 10.682733] NIP: c0431480 LR: c043147c CTR: c0422ad8
[ 10.682863] REGS: cf82fbe0 TRAP: 0300 Tainted: G W (5.0.0-rc6-next-20190218+)
[ 10.683065] MSR: 00029000 <CE,EE,ME> CR: 22000222 XER: 00000000
[ 10.683236] DEAR: 00000040 ESR: 00000000
[ 10.683236] GPR00: c043147c cf82fc90 cf82ccc0 00000000 00000000 00000000 00000002 00000000
[ 10.683236] GPR08: 00000000 00000000 c04310bc 00000000 22000222 00000000 c0002c54 00000000
[ 10.683236] GPR16: 00000000 00000001 c09aa39c c09021b0 c09021dc 00000007 c0a68c08 00000000
[ 10.683236] GPR24: 00000001 ced6d400 ced6dcf0 c0815d9c 00000000 00000000 00000000 cedf0800
[ 10.684331] NIP [c0431480] blk_mq_run_hw_queue+0x28/0x114
[ 10.684473] LR [c043147c] blk_mq_run_hw_queue+0x24/0x114
[ 10.684602] Call Trace:
[ 10.684671] [cf82fc90] [c043147c] blk_mq_run_hw_queue+0x24/0x114 (unreliable)
[ 10.684854] [cf82fcc0] [c04315bc] blk_mq_run_hw_queues+0x50/0x7c
[ 10.685002] [cf82fce0] [c0422b24] blk_set_queue_dying+0x30/0x68
[ 10.685154] [cf82fcf0] [c0423ec0] blk_cleanup_queue+0x34/0x14c
[ 10.685306] [cf82fd10] [c054d73c] ace_probe+0x3dc/0x508
[ 10.685445] [cf82fd50] [c052d740] platform_drv_probe+0x4c/0xb8
[ 10.685592] [cf82fd70] [c052abb0] really_probe+0x20c/0x32c
[ 10.685728] [cf82fda0] [c052ae58] driver_probe_device+0x68/0x464
[ 10.685877] [cf82fdc0] [c052b500] device_driver_attach+0xb4/0xe4
[ 10.686024] [cf82fde0] [c052b5dc] __driver_attach+0xac/0xfc
[ 10.686161] [cf82fe00] [c0528428] bus_for_each_dev+0x80/0xc0
[ 10.686314] [cf82fe30] [c0529b3c] bus_add_driver+0x144/0x234
[ 10.686457] [cf82fe50] [c052c46c] driver_register+0x88/0x15c
[ 10.686610] [cf82fe60] [c09de288] ace_init+0x4c/0xac
[ 10.686742] [cf82fe80] [c0002730] do_one_initcall+0xac/0x330
[ 10.686888] [cf82fee0] [c09aafd0] kernel_init_freeable+0x34c/0x478
[ 10.687043] [cf82ff30] [c0002c6c] kernel_init+0x18/0x114
[ 10.687188] [cf82ff40] [c000f2f0] ret_from_kernel_thread+0x14/0x1c
[ 10.687349] Instruction dump:
[ 10.687435] 3863ffd4 4bfffd70 9421ffd0 7c0802a6 93c10028 7c9e2378 93e1002c 38810008
[ 10.687637] 7c7f1b78 90010034 4bfffc25 813f008c <81290040> 75290100 4182002c 80810008
[ 10.688056] ---[ end trace 13c9ff51d41b9d40 ]---
Fix the problem by setting the disk queue pointer to NULL before calling
put_disk(). A more comprehensive fix might be to rearrange the code
to check the hardware version before initializing data structures,
but I don't know if this would have undesirable side effects, and
it would increase the complexity of backporting the fix to older kernels.
Fixes: 74489a91dd43a ("Add support for Xilinx SystemACE CompactFlash interface")
Acked-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/xsysace.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/block/xsysace.c b/drivers/block/xsysace.c
index c4328d9d9981..f838119d12b2 100644
--- a/drivers/block/xsysace.c
+++ b/drivers/block/xsysace.c
@@ -1062,6 +1062,8 @@ static int ace_setup(struct ace_device *ace)
return 0;
err_read:
+ /* prevent double queue cleanup */
+ ace->gd->queue = NULL;
put_disk(ace->gd);
err_alloc_disk:
blk_cleanup_queue(ace->queue);
--
2.20.1
next prev parent reply other threads:[~2019-05-15 10:59 UTC|newest]
Thread overview: 93+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-15 10:54 [PATCH 3.18 00/86] 3.18.140-stable review Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 01/86] MIPS: scall64-o32: Fix indirect syscall number load Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 02/86] trace: Fix preempt_enable_no_resched() abuse Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 03/86] sched/numa: Fix a possible divide-by-zero Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 04/86] ceph: ensure d_name stability in ceph_dentry_hash() Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 05/86] sunrpc: dont mark uninitialised items as VALID Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 06/86] slip: make slhc_free() silently accept an error pointer Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 07/86] fs/proc/proc_sysctl.c: Fix a NULL pointer dereference Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 08/86] NFS: Forbid setting AF_INET6 to "struct sockaddr_in"->sin_family Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 09/86] netfilter: ebtables: CONFIG_COMPAT: drop a bogus WARN_ON Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 10/86] Revert "block/loop: Use global lock for ioctl() operation." Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 11/86] ipv4: add sanity checks in ipv4_link_failure() Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 12/86] team: fix possible recursive locking when add slaves Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 13/86] net: stmmac: move stmmac_check_ether_addr() to driver probe Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 14/86] qlcnic: Avoid potential NULL pointer dereference Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 15/86] usb: gadget: net2280: Fix overrun of OUT messages Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 16/86] usb: gadget: net2272: Fix net2272_dequeue() Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 17/86] net: ks8851: Dequeue RX packets explicitly Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 18/86] net: ks8851: Reassert reset pin if chip ID check fails Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 19/86] net: ks8851: Delay requesting IRQ until opened Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 20/86] net: ks8851: Set initial carrier state to down Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 21/86] net: ibm: fix possible object reference leak Greg Kroah-Hartman
2019-05-15 10:54 ` [PATCH 3.18 22/86] scsi: qla4xxx: fix a potential NULL pointer dereference Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 23/86] usb: u132-hcd: fix resource leak Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 24/86] ceph: fix use-after-free on symlink traversal Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 25/86] scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 26/86] libata: fix using DMA buffers on stack Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 27/86] kconfig/[mn]conf: handle backspace (^H) key Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 28/86] ipv4: ip_do_fragment: Preserve skb_iif during fragmentation Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 29/86] ipv6: invert flowlabel sharing check in process and user mode Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 30/86] packet: validate msg_namelen in send directly Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 31/86] ipv6/flowlabel: wait rcu grace period before put_pid() Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 32/86] USB: yurex: Fix protection fault after device removal Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 33/86] USB: w1 ds2490: Fix bug caused by improper use of altsetting array Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 34/86] USB: core: Fix unterminated string returned by usb_string() Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 35/86] USB: media: disable tlg2300 driver Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 36/86] USB: core: Fix bug caused by duplicate interface PM usage counter Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 37/86] HID: debug: fix race condition with between rdesc_show() and device removal Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 38/86] rtc: sh: Fix invalid alarm warning for non-enabled alarm Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 39/86] igb: Fix WARN_ONCE on runtime suspend Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 40/86] bonding: show full hw address in sysfs for slave entries Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 41/86] jffs2: fix use-after-free on symlink traversal Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 42/86] scsi: storvsc: Fix calculation of sub-channel count Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 43/86] hugetlbfs: fix memory leak for resv_map Greg Kroah-Hartman
2019-05-15 10:55 ` Greg Kroah-Hartman [this message]
2019-05-15 10:55 ` [PATCH 3.18 45/86] ARM: orion: dont use using 64-bit DMA masks Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 46/86] ARM: iop: " Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 47/86] usb: usbip: fix isoc packet num validation in get_pipe Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 48/86] staging: iio: adt7316: allow adt751x to use internal vref for all dacs Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 49/86] staging: iio: adt7316: fix the dac read calculation Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 50/86] staging: iio: adt7316: fix the dac write calculation Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 51/86] media: v4l2: i2c: ov7670: Fix PLL bypass register values Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 52/86] scsi: libsas: fix a race condition when smp task timeout Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 53/86] ASoC:soc-pcm:fix a codec fixup issue in TDM case Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 54/86] ASoC: cs4270: Set auto-increment bit for register writes Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 55/86] ASoC: tlv320aic32x4: Fix Common Pins Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 56/86] scsi: csiostor: fix missing data copy in csio_scsi_err_handler() Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 57/86] iommu/amd: Set exclusion range correctly Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 58/86] genirq: Prevent use-after-free and work list corruption Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 59/86] scsi: qla2xxx: Fix incorrect region-size setting in optrom SYSFS routines Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 60/86] Bluetooth: hidp: fix buffer overflow Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 61/86] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 62/86] timer/debug: Change /proc/timer_stats from 0644 to 0600 Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 63/86] netfilter: compat: initialize all fields in xt_init Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 64/86] platform/x86: sony-laptop: Fix unintentional fall-through Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 65/86] iio: adc: xilinx: fix potential use-after-free on remove Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 66/86] HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 67/86] s390/dasd: Fix capacity calculation for large volumes Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 68/86] s390/3270: fix lockdep false positive on view->lock Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 69/86] KVM: x86: avoid misreporting level-triggered irqs as edge-triggered in tracing Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 70/86] tools lib traceevent: Fix missing equality check for strcmp Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 71/86] init: initialize jump labels before command line option parsing Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 72/86] s390: ctcm: fix ctcm_new_device error return code Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 73/86] selftests/net: correct the return value for run_netsocktests Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 74/86] gpu: ipu-v3: dp: fix CSC handling Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 75/86] Dont jump to compute_result state from check_result state Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 76/86] USB: serial: use variable for status Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 77/86] USB: serial: fix unthrottle races Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 78/86] bridge: Fix error path for kobject_init_and_add() Greg Kroah-Hartman
2019-05-15 20:48 ` Tobin C. Harding
2019-05-16 5:57 ` Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 79/86] net: ucc_geth - fix Oops when changing number of buffers in the ring Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 80/86] packet: Fix error path in packet_init Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 81/86] vlan: disable SIOCSHWTSTAMP in container Greg Kroah-Hartman
2019-05-15 10:55 ` [PATCH 3.18 82/86] ipv4: Fix raw socket lookup for local traffic Greg Kroah-Hartman
2019-05-15 10:56 ` [PATCH 3.18 83/86] bonding: fix arp_validate toggling in active-backup mode Greg Kroah-Hartman
2019-05-15 10:56 ` [PATCH 3.18 84/86] drivers/virt/fsl_hypervisor.c: dereferencing error pointers in ioctl Greg Kroah-Hartman
2019-05-15 10:56 ` [PATCH 3.18 85/86] drivers/virt/fsl_hypervisor.c: prevent integer overflow " Greg Kroah-Hartman
2019-05-15 10:56 ` [PATCH 3.18 86/86] powerpc/booke64: set RI in default MSR Greg Kroah-Hartman
2019-05-15 15:07 ` [PATCH 3.18 00/86] 3.18.140-stable review kernelci.org bot
2019-05-16 3:33 ` Guenter Roeck
2019-05-16 14:27 ` shuah
2019-05-16 14:59 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190515090651.167896292@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=axboe@kernel.dk \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=michal.simek@xilinx.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.