From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Lijun Pan <ljp@linux.ibm.com>,
Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.4 66/98] ibmvnic: fix NULL pointer dereference in ibmvic_reset_crq
Date: Tue, 1 Dec 2020 09:53:43 +0100 [thread overview]
Message-ID: <20201201084658.314368538@linuxfoundation.org> (raw)
In-Reply-To: <20201201084652.827177826@linuxfoundation.org>
From: Lijun Pan <ljp@linux.ibm.com>
[ Upstream commit 0e435befaea45f7ea58682eecab5e37e05b2ce65 ]
crq->msgs could be NULL if the previous reset did not complete after
freeing crq->msgs. Check for NULL before dereferencing them.
Snippet of call trace:
...
ibmvnic 30000003 env3 (unregistering): Releasing sub-CRQ
ibmvnic 30000003 env3 (unregistering): Releasing CRQ
BUG: Kernel NULL pointer dereference on read at 0x00000000
Faulting instruction address: 0xc0000000000c1a30
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in: ibmvnic(E-) rpadlpar_io rpaphp xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables xsk_diag tcp_diag udp_diag tun raw_diag inet_diag unix_diag bridge af_packet_diag netlink_diag stp llc rfkill sunrpc pseries_rng xts vmx_crypto uio_pdrv_genirq uio binfmt_misc ip_tables xfs libcrc32c sd_mod t10_pi sg ibmvscsi ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ibmvnic]
CPU: 20 PID: 8426 Comm: kworker/20:0 Tainted: G E 5.10.0-rc1+ #12
Workqueue: events __ibmvnic_reset [ibmvnic]
NIP: c0000000000c1a30 LR: c008000001b00c18 CTR: 0000000000000400
REGS: c00000000d05b7a0 TRAP: 0380 Tainted: G E (5.10.0-rc1+)
MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 44002480 XER: 20040000
CFAR: c0000000000c19ec IRQMASK: 0
GPR00: 0000000000000400 c00000000d05ba30 c008000001b17c00 0000000000000000
GPR04: 0000000000000000 0000000000000000 0000000000000000 00000000000001e2
GPR08: 000000000001f400 ffffffffffffd950 0000000000000000 c008000001b0b280
GPR12: c0000000000c19c8 c00000001ec72e00 c00000000019a778 c00000002647b440
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000006 0000000000000001 0000000000000003 0000000000000002
GPR24: 0000000000001000 c008000001b0d570 0000000000000005 c00000007ab5d550
GPR28: c00000007ab5c000 c000000032fcf848 c00000007ab5cc00 c000000032fcf800
NIP [c0000000000c1a30] memset+0x68/0x104
LR [c008000001b00c18] ibmvnic_reset_crq+0x70/0x110 [ibmvnic]
Call Trace:
[c00000000d05ba30] [0000000000000800] 0x800 (unreliable)
[c00000000d05bab0] [c008000001b0a930] do_reset.isra.40+0x224/0x634 [ibmvnic]
[c00000000d05bb80] [c008000001b08574] __ibmvnic_reset+0x17c/0x3c0 [ibmvnic]
[c00000000d05bc50] [c00000000018d9ac] process_one_work+0x2cc/0x800
[c00000000d05bd20] [c00000000018df58] worker_thread+0x78/0x520
[c00000000d05bdb0] [c00000000019a934] kthread+0x1c4/0x1d0
[c00000000d05be20] [c00000000000d5d0] ret_from_kernel_thread+0x5c/0x6c
Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
Signed-off-by: Lijun Pan <ljp@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 238915410d79a..e53994ca3142c 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -4777,6 +4777,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter)
} while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
/* Clean out the queue */
+ if (!crq->msgs)
+ return -EINVAL;
+
memset(crq->msgs, 0, PAGE_SIZE);
crq->cur = 0;
crq->active = false;
--
2.27.0
next prev parent reply other threads:[~2020-12-01 9:25 UTC|newest]
Thread overview: 110+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-01 8:52 [PATCH 5.4 00/98] 5.4.81-rc1 review Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 01/98] spi: bcm-qspi: Fix use-after-free on unbind Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 02/98] spi: bcm2835: " Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 03/98] ipv4: use IS_ENABLED instead of ifdef Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 04/98] netfilter: clear skb->next in NF_HOOK_LIST() Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 05/98] btrfs: tree-checker: add missing return after error in root_item Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 06/98] btrfs: tree-checker: add missing returns after data_ref alignment checks Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 07/98] btrfs: dont access possibly stale fs_info data for printing duplicate device Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 08/98] btrfs: fix lockdep splat when reading qgroup config on mount Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 09/98] wireless: Use linux/stddef.h instead of stddef.h Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 10/98] smb3: Call cifs reconnect from demultiplex thread Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 11/98] smb3: Avoid Mid pending list corruption Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 12/98] smb3: Handle error case during offload read path Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 13/98] cifs: fix a memleak with modefromsid Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 14/98] KVM: PPC: Book3S HV: XIVE: Fix possible oops when accessing ESB page Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 15/98] KVM: arm64: vgic-v3: Drop the reporting of GICR_TYPER.Last for userspace Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 16/98] KVM: x86: handle !lapic_in_kernel case in kvm_cpu_*_extint Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 17/98] KVM: x86: Fix split-irqchip vs interrupt injection window request Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 18/98] trace: fix potenial dangerous pointer Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 19/98] arm64: pgtable: Fix pte_accessible() Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 20/98] arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 21/98] HID: uclogic: Add ID for Trust Flex Design Tablet Greg Kroah-Hartman
2020-12-01 8:52 ` [PATCH 5.4 22/98] HID: ite: Replace ABS_MISC 120/121 events with touchpad on/off keypresses Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 23/98] HID: cypress: Support Varmilo Keyboards media hotkeys Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 24/98] HID: add support for Sega Saturn Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 25/98] Input: i8042 - allow insmod to succeed on devices without an i8042 controller Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 26/98] HID: hid-sensor-hub: Fix issue with devices with no report ID Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 27/98] staging: ralink-gdma: fix kconfig dependency bug for DMA_RALINK Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 28/98] HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 29/98] dmaengine: xilinx_dma: use readl_poll_timeout_atomic variant Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 30/98] x86/xen: dont unbind uninitialized lock_kicker_irq Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 31/98] HID: logitech-hidpp: Add HIDPP_CONSUMER_VENDOR_KEYS quirk for the Dinovo Edge Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 32/98] HID: Add Logitech Dinovo Edge battery quirk Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 33/98] proc: dont allow async path resolution of /proc/self components Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 34/98] nvme: free sq/cq dbbuf pointers when dbbuf set fails Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 35/98] vhost scsi: fix cmd completion race Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 36/98] dmaengine: pl330: _prep_dma_memcpy: Fix wrong burst size Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 37/98] scsi: libiscsi: Fix NOP race condition Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 38/98] scsi: target: iscsi: Fix cmd abort fabric stop race Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 39/98] perf/x86: fix sysfs type mismatches Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 40/98] xtensa: uaccess: Add missing __user to strncpy_from_user() prototype Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 41/98] net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 42/98] bus: ti-sysc: Fix bogus resetdone warning on enable for cpsw Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 43/98] ARM: OMAP2+: Manage MPU state properly for omap_enter_idle_coupled() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 44/98] phy: tegra: xusb: Fix dangling pointer on probe failure Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 45/98] iwlwifi: mvm: write queue_sync_state only for sync Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 46/98] batman-adv: set .owner to THIS_MODULE Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 47/98] arch: pgtable: define MAX_POSSIBLE_PHYSMEM_BITS where needed Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 48/98] ARM: dts: dra76x: m_can: fix order of clocks Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 49/98] scsi: ufs: Fix race between shutdown and runtime resume flow Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 50/98] bnxt_en: fix error return code in bnxt_init_one() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 51/98] bnxt_en: fix error return code in bnxt_init_board() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 52/98] video: hyperv_fb: Fix the cache type when mapping the VRAM Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 53/98] bnxt_en: Release PCI regions when DMA mask setup fails during probe Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 54/98] cxgb4: fix the panic caused by non smac rewrite Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 55/98] s390/qeth: make af_iucv TX notification call more robust Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 56/98] s390/qeth: fix af_iucv notification race Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 57/98] s390/qeth: fix tear down of async TX buffers Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 58/98] ibmvnic: fix call_netdevice_notifiers in do_reset Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 59/98] ibmvnic: notify peers when failover and migration happen Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 60/98] powerpc/64s: Fix allnoconfig build since uaccess flush Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 61/98] IB/mthca: fix return value of error branch in mthca_init_cq() Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 62/98] i40e: Fix removing driver while bare-metal VFs pass traffic Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 63/98] nfc: s3fwrn5: use signed integer for parsing GPIO numbers Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 64/98] net: ena: set initial DMA width to avoid intel iommu issue Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 65/98] ibmvnic: fix NULL pointer dereference in reset_sub_crq_queues Greg Kroah-Hartman
2020-12-01 8:53 ` Greg Kroah-Hartman [this message]
2020-12-01 8:53 ` [PATCH 5.4 67/98] optee: add writeback to valid memory type Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 68/98] arm64: tegra: Wrong AON HSP reg property size Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 69/98] efivarfs: revert "fix memory leak in efivarfs_create()" Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 70/98] efi: EFI_EARLYCON should depend on EFI Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 71/98] can: gs_usb: fix endianess problem with candleLight firmware Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 72/98] platform/x86: thinkpad_acpi: Send tablet mode switch at wakeup time Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 73/98] platform/x86: toshiba_acpi: Fix the wrong variable assignment Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 74/98] RDMA/hns: Fix retry_cnt and rnr_cnt when querying QP Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 75/98] RDMA/hns: Bugfix for memory window mtpt configuration Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 76/98] can: m_can: m_can_open(): remove IRQF_TRIGGER_FALLING from request_threaded_irq()s flags Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 77/98] can: m_can: fix nominal bitiming tseg2 min for version >= 3.1 Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 78/98] perf stat: Use proper cpu for shadow stats Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 79/98] perf probe: Fix to die_entrypc() returns error correctly Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 80/98] spi: bcm2835aux: Restore err assignment in bcm2835aux_spi_probe Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 81/98] USB: core: Change %pK for __user pointers to %px Greg Kroah-Hartman
2020-12-01 8:53 ` [PATCH 5.4 82/98] usb: gadget: f_midi: Fix memleak in f_midi_alloc Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 83/98] USB: quirks: Add USB_QUIRK_DISCONNECT_SUSPEND quirk for Lenovo A630Z TIO built-in usb-audio card Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 84/98] usb: gadget: Fix memleak in gadgetfs_fill_super Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 85/98] irqchip/exiu: Fix the index of fwspec for IRQ type Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 86/98] x86/mce: Do not overwrite no_way_out if mce_end() fails Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 87/98] x86/speculation: Fix prctl() when spectre_v2_user={seccomp,prctl},ibpb Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 88/98] x86/resctrl: Remove superfluous kernfs_get() calls to prevent refcount leak Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 89/98] x86/resctrl: Add necessary kernfs_put() " Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 90/98] USB: core: Fix regression in Hercules audio card Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 91/98] ASoC: Intel: Skylake: Remove superfluous chip initialization Greg Kroah-Hartman
2020-12-01 8:54 ` Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 92/98] ASoC: Intel: Skylake: Select hda configuration permissively Greg Kroah-Hartman
2020-12-01 8:54 ` Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 93/98] ASoC: Intel: Skylake: Enable codec wakeup during chip init Greg Kroah-Hartman
2020-12-01 8:54 ` Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 94/98] ASoC: Intel: Skylake: Shield against no-NHLT configurations Greg Kroah-Hartman
2020-12-01 8:54 ` Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 95/98] ASoC: Intel: Allow for ROM init retry on CNL platforms Greg Kroah-Hartman
2020-12-01 8:54 ` Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 96/98] ASoC: Intel: Skylake: Await purge request ack on CNL Greg Kroah-Hartman
2020-12-01 8:54 ` Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 97/98] ASoC: Intel: Multiple I/O PCM format support for pipe Greg Kroah-Hartman
2020-12-01 8:54 ` Greg Kroah-Hartman
2020-12-01 8:54 ` [PATCH 5.4 98/98] ASoC: Intel: Skylake: Automatic DMIC format configuration according to information from NHLT Greg Kroah-Hartman
2020-12-01 13:39 ` [PATCH 5.4 00/98] 5.4.81-rc1 review Jon Hunter
2020-12-01 21:40 ` Guenter Roeck
2020-12-02 4:58 ` Naresh Kamboju
2020-12-02 16:57 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201201084658.314368538@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ljp@linux.ibm.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.