From: Alexander Lobakin <aleksander.lobakin@intel.com>
To: "David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Alexander Lobakin <aleksander.lobakin@intel.com>,
Michael Chan <michael.chan@broadcom.com>,
Somnath Kotur <somnath.kotur@broadcom.com>,
Pavan Chebbi <pavan.chebbi@broadcom.com>,
Kalesh AP <kalesh-anakkur.purayil@broadcom.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH net-next] bnxt_en: fix accessing vnic_info before allocating it
Date: Mon, 26 Feb 2024 15:49:11 +0100 [thread overview]
Message-ID: <20240226144911.1297336-1-aleksander.lobakin@intel.com> (raw)
bnxt_alloc_mem() dereferences ::vnic_info in the variable declaration
block, but allocates it much later. As a result, the following crash
happens on my setup:
BUG: kernel NULL pointer dereference, address: 0000000000000090
fbcon: Taking over console
#PF: supervisor write access in kernel mode
#PF: error_code (0x0002) - not-present page
PGD 12f382067 P4D 0
Oops: 8002 [#1] PREEMPT SMP NOPTI
CPU: 47 PID: 2516 Comm: NetworkManager Not tainted 6.8.0-rc5-libeth+ #49
Hardware name: Intel Corporation M50CYP2SBSTD/M58CYP2SBSTD, BIOS SE5C620.86B.01.01.0088.2305172341 05/17/2023
RIP: 0010:bnxt_alloc_mem+0x1609/0x1910 [bnxt_en]
Code: 81 c8 48 83 c8 08 31 c9 e9 d7 fe ff ff c7 44 24 Oc 00 00 00 00 49 89 d5 e9 2d fe ff ff 41 89 c6 e9 88 00 00 00 48 8b 44 24 50 <80> 88 90 00 00 00 Od 8b 43 74 a8 02 75 1e f6 83 14 02 00 00 80 74
RSP: 0018:ff3f25580f3432c8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ff15a5cfc45249e0 RCX: 0000002079777000
RDX: ff15a5dfb9767000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ff15a5dfb9777000 R11: ffffff8000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000020 R15: ff15a5cfce34f540
FS: 000007fb9a160500(0000) GS:ff15a5dfbefc0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CRO: 0000000080050033
CR2: 0000000000000090 CR3: 0000000109efc00Z CR4: 0000000000771ef0
DR0: 0000000000000000 DR1: 0000000000000000 DRZ: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
? __die_body+0x68/0xb0
? page_fault_oops+0x3a6/0x400
? exc_page_fault+0x7a/0x1b0
? asm_exc_page_fault+0x26/8x30
? bnxt_alloc_mem+0x1609/0x1910 [bnxt_en]
? bnxt_alloc_mem+0x1389/8x1918 [bnxt_en]
_bnxt_open_nic+0x198/0xa50 [bnxt_en]
? bnxt_hurm_if_change+0x287/0x3d0 [bnxt_en]
bnxt_open+0xeb/0x1b0 [bnxt_en]
_dev_open+0x12e/0x1f0
_dev_change_flags+0xb0/0x200
dev_change_flags+0x25/0x60
do_setlink+0x463/0x1260
? sock_def_readable+0x14/0xc0
? rtnl_getlink+0x4b9/0x590
? _nla_validate_parse+0x91/0xfa0
rtnl_newlink+0xbac/0xe40
<...>
Don't create a variable and dereference the first array member directly
since it's used only once in the code.
Fixes: ef4ee64e9990 ("bnxt_en: Define BNXT_VNIC_DEFAULT for the default vnic index")
Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 9968d67e6c77..a15e6d31fc22 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5004,7 +5004,6 @@ static void bnxt_free_mem(struct bnxt *bp, bool irq_re_init)
static int bnxt_alloc_mem(struct bnxt *bp, bool irq_re_init)
{
- struct bnxt_vnic_info *vnic0 = &bp->vnic_info[BNXT_VNIC_DEFAULT];
int i, j, rc, size, arr_size;
void *bnapi;
@@ -5133,8 +5132,9 @@ static int bnxt_alloc_mem(struct bnxt *bp, bool irq_re_init)
if (rc)
goto alloc_mem_err;
- vnic0->flags |= BNXT_VNIC_RSS_FLAG | BNXT_VNIC_MCAST_FLAG |
- BNXT_VNIC_UCAST_FLAG;
+ bp->vnic_info[BNXT_VNIC_DEFAULT].flags |= BNXT_VNIC_RSS_FLAG |
+ BNXT_VNIC_MCAST_FLAG |
+ BNXT_VNIC_UCAST_FLAG;
if (BNXT_SUPPORTS_NTUPLE_VNIC(bp) && (bp->flags & BNXT_FLAG_RFS))
bp->vnic_info[BNXT_VNIC_NTUPLE].flags |=
BNXT_VNIC_RSS_FLAG | BNXT_VNIC_NTUPLE_FLAG;
--
2.43.2
next reply other threads:[~2024-02-26 14:49 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-26 14:49 Alexander Lobakin [this message]
2024-02-26 15:43 ` [PATCH net-next] bnxt_en: fix accessing vnic_info before allocating it Jiri Pirko
2024-02-26 16:26 ` Michael Chan
2024-02-27 16:40 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240226144911.1297336-1-aleksander.lobakin@intel.com \
--to=aleksander.lobakin@intel.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kalesh-anakkur.purayil@broadcom.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=michael.chan@broadcom.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pavan.chebbi@broadcom.com \
--cc=somnath.kotur@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.