From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
To: Coiby Xu <coiby.xu@gmail.com>
Cc: devel@driverdev.osuosl.org,
Benjamin Poirier <benjamin.poirier@gmail.com>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
Dan Carpenter <dan.carpenter@oracle.com>,
Manish Chopra <manishc@marvell.com>,
"supporter:QLOGIC QLGE 10Gb ETHERNET DRIVER"
<GR-Linux-NIC-Dev@marvell.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
open list <linux-kernel@vger.kernel.org>,
"open list:QLOGIC QLGE 10Gb ETHERNET DRIVER"
<netdev@vger.kernel.org>
Subject: Re: [PATCH v2 2/7] staging: qlge: Initialize devlink health dump framework
Date: Tue, 20 Oct 2020 16:36:09 +0800 [thread overview]
Message-ID: <20201020083609.GL7183@syu-laptop> (raw)
In-Reply-To: <20201014104306.63756-3-coiby.xu@gmail.com>
Hi,
This patch trigger the following KASAN error inside qlge_init_device().
[...] general protection fault, probably for non-canonical address 0xdffffc000000004b: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[...] KASAN: null-ptr-deref in range [0x0000000000000258-0x000000000000025f]
[...] CPU: 0 PID: 438 Comm: systemd-udevd Tainted: G C E 5.9.0-kvmsmall+ #7
[...] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-48-
g...ilt.opensuse.org 04/01/2014
[...] RIP: 0010:qlge_get_8000_flash_params+0x377/0x6e0 [qlge]
[...] Code: 03 80 3c 02 00 0f 85 57 03 00 00 49 8b af 68 08 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bd 5f 02 00 00 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 c6 02 00 00
[...] RSP: 0018:ffffc90000f97788 EFLAGS: 00010207
[...] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[...] RDX: 000000000000004b RSI: ffffffffc08cb843 RDI: 000000000000025f
[...] R10: fffffbfff5f718a0 R11: 0000000000000001 R12: dffffc0000000000
[...] R13: ffff888111085d40 R14: ffff888111085d40 R15: ffff888111080280
[...] FS: 00007f315f5db280(0000) GS:ffff8881f5200000(0000) knlGS:0000000000000000
[...] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[...] CR2: 000055bb25297170 CR3: 0000000110674000 CR4: 00000000000006f0
[...] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[...] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[...] Call Trace:
[...] ? qlge_get_8012_flash_params+0x600/0x600 [qlge]
[...] ? static_obj+0x8a/0xc0
[...] ? lockdep_init_map_waits+0x26a/0x700
[...] qlge_init_device+0x425/0x1000 [qlge]
[...] ? debug_mutex_init+0x31/0x60
[...] qlge_probe+0xfe/0x6c0 [qlge]
[...] ? qlge_set_mac_addr+0x330/0x330 [qlge]
[...] local_pci_probe+0xd8/0x170
[...] pci_call_probe+0x156/0x3d0
[...] ? pci_match_device+0x30c/0x620
[...] ? pci_pm_suspend_noirq+0x980/0x980
[...] ? pci_match_device+0x33c/0x620
[...] ? kernfs_put+0x18/0x30
[...] pci_device_probe+0x1e0/0x270
[...] ? pci_dma_configure+0x57/0xd0
[...] really_probe+0x218/0xd20
[...] driver_probe_device+0x1e6/0x2c0
[...] device_driver_attach+0x209/0x270
[...] __driver_attach+0xf6/0x260
[...] ? device_driver_attach+0x270/0x270
[...] bus_for_each_dev+0x114/0x1a0
[...] ? subsys_find_device_by_id+0x2d0/0x2d0
[...] ? bus_add_driver+0x2d2/0x620
[...] bus_add_driver+0x352/0x620
[...] driver_register+0x1ee/0x4b0
[...] ? 0xffffffffc08e9000
[...] do_one_initcall+0xbb/0x400
[...] ? trace_event_raw_event_initcall_finish+0x1c0/0x1c0
[...] ? rcu_read_lock_sched_held+0x3f/0x70
[...] ? trace_kmalloc+0xa2/0xd0
[...] ? kasan_unpoison_shadow+0x33/0x40
[...] ? kasan_unpoison_shadow+0x33/0x40
[...] do_init_module+0x1ce/0x780
[...] load_module+0x14b1/0x16d0
[...] ? post_relocation+0x3a0/0x3a0
[...] ? device_driver_attach+0x270/0x270
[...] bus_for_each_dev+0x114/0x1a0
[...] ? subsys_find_device_by_id+0x2d0/0x2d0
[...] ? bus_add_driver+0x2d2/0x620
[...] bus_add_driver+0x352/0x620
[...] driver_register+0x1ee/0x4b0
[...] ? 0xffffffffc08e9000
[...] do_one_initcall+0xbb/0x400
[...] ? trace_event_raw_event_initcall_finish+0x1c0/0x1c0
[...] ? rcu_read_lock_sched_held+0x3f/0x70
[...] ? trace_kmalloc+0xa2/0xd0
[...] ? kasan_unpoison_shadow+0x33/0x40
[...] ? kasan_unpoison_shadow+0x33/0x40
[...] do_init_module+0x1ce/0x780
[...] load_module+0x14b1/0x16d0
[...] ? post_relocation+0x3a0/0x3a0
[...] ? kernel_read_file_from_fd+0x4b/0x90
[...] __do_sys_finit_module+0x110/0x1a0
[...] ? __ia32_sys_init_module+0xa0/0xa0
[...] do_syscall_64+0x33/0x80
[...] entry_SYSCALL_64_after_hwframe+0x44/0xa9
With qlge_get_8000_flash_params+0x377/0x6e0 corresponding to the following:
if (qdev->flash.flash_params_8000.data_type1 == 2)
memcpy(mac_addr,
qdev->flash.flash_params_8000.mac_addr1,
qdev->ndev->addr_len); // <---- Here
IIRC I didn't see this with v1. However I didn't test v2, so I'm not sure if
this issue is introduced during v2 or v3.
Best,
Shung-Hsi
next prev parent reply other threads:[~2020-10-20 8:36 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20201014104306.63756-1-coiby.xu@gmail.com>
2020-10-14 10:43 ` [PATCH v2 1/7] staging: qlge: replace ql_* with qlge_* to avoid namespace clashes with other qlogic drivers Coiby Xu
2020-10-15 1:01 ` Benjamin Poirier
2020-10-15 4:26 ` Coiby Xu
2020-10-15 4:32 ` Coiby Xu
2020-10-16 23:16 ` Coiby Xu
2020-10-18 11:02 ` Benjamin Poirier
2020-10-19 2:12 ` Coiby Xu
2020-10-14 10:43 ` [PATCH v2 2/7] staging: qlge: Initialize devlink health dump framework Coiby Xu
2020-10-14 13:08 ` Dan Carpenter
2020-10-15 4:22 ` Coiby Xu
2020-10-20 8:36 ` Shung-Hsi Yu [this message]
2020-10-20 8:55 ` Shung-Hsi Yu
2020-10-14 10:43 ` [PATCH v2 3/7] staging: qlge: coredump via devlink health reporter Coiby Xu
2020-10-14 10:43 ` [PATCH v2 4/7] staging: qlge: support force_coredump option for devlink health dump Coiby Xu
2020-10-14 10:43 ` [PATCH v2 5/7] staging: qlge: remove mpi_core_to_log which sends coredump to the kernel ring buffer Coiby Xu
2020-10-14 10:43 ` [PATCH v2 6/7] staging: qlge: clean up debugging code in the QL_ALL_DUMP ifdef land Coiby Xu
2020-10-14 10:43 ` [PATCH v2 7/7] staging: qlge: add documentation for debugging qlge Coiby Xu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201020083609.GL7183@syu-laptop \
--to=shung-hsi.yu@suse.com \
--cc=GR-Linux-NIC-Dev@marvell.com \
--cc=benjamin.poirier@gmail.com \
--cc=coiby.xu@gmail.com \
--cc=dan.carpenter@oracle.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=manishc@marvell.com \
--cc=netdev@vger.kernel.org \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.