From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yonglong Liu <liuyonglong@huawei.com>,
Huazhong Tan <tanhuazhong@huawei.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 23/83] net: hns: Fix use after free identified by SLUB debug
Date: Tue, 12 Feb 2019 21:36:01 -0500 [thread overview]
Message-ID: <20190213023701.20286-23-sashal@kernel.org> (raw)
In-Reply-To: <20190213023701.20286-1-sashal@kernel.org>
From: Yonglong Liu <liuyonglong@huawei.com>
[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ]
When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will
identify a use after free bug:
[134.189505] Unable to handle kernel paging request at virtual address
006b6b6b6b6b6b6b
[134.197553] Mem abort info:
[134.200381] ESR = 0x96000004
[134.203487] Exception class = DABT (current EL), IL = 32 bits
[134.209497] SET = 0, FnV = 0
[134.212596] EA = 0, S1PTW = 0
[134.215777] Data abort info:
[134.218701] ISV = 0, ISS = 0x00000004
[134.222596] CM = 0, WnR = 0
[134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges
[134.232851] Internal error: Oops: 96000004 [#1] SMP
[134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G
OE 4.19.5-1.2.34.aarch64 #1
[134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018
[134.255181] pstate: 20000005 (nzCv daif -PAN -UAO)
[134.260044] pc : hns_ae_put_handle+0x38/0x60
[134.264372] lr : hns_ae_put_handle+0x24/0x60
[134.268700] sp : ffff00001be93c50
[134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040
[134.277442] x27: 0000000000000000 x26: 0000000000000000
[134.282830] x25: 0000000056000000 x24: 0000000000000015
[134.288284] x23: ffff0000096fe098 x22: ffff000001050070
[134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098
[134.303287] x19: ffff80afb75ec098 x18: 0000000000000000
[134.312945] x17: 0000000000000000 x16: 0000000000000000
[134.322517] x15: 0000000000000002 x14: 0000000000000000
[134.332030] x13: dead000000000100 x12: ffff7e02bea3c988
[134.341487] x11: ffff80affbee9e68 x10: 0000000000000000
[134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000
[134.360569] x7 : dead000000000100 x6 : ffff000009579748
[134.370059] x5 : 0000000000210d00 x4 : 0000000000000000
[134.379550] x3 : 0000000000000001 x2 : 0000000000000000
[134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000
[134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd)
[134.408498] Call trace:
[134.414611] hns_ae_put_handle+0x38/0x60
[134.422208] hnae_put_handle+0xd4/0x108
[134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv]
[134.438342] platform_drv_remove+0x2c/0x70
[134.445958] device_release_driver_internal+0x174/0x208
[134.454810] driver_detach+0x70/0xd8
[134.461913] bus_remove_driver+0x64/0xe8
[134.469396] driver_unregister+0x34/0x60
[134.476822] platform_driver_unregister+0x20/0x30
[134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv]
[134.494634] __arm64_sys_delete_module+0x238/0x290
struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is
freed, than use hnae_handle will cause use after free panic.
This patch frees vf_cb after hnae_handle used.
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
index ad1779fc410e..a78bfafd212c 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
int i;
- vf_cb->mac_cb = NULL;
-
- kfree(vf_cb);
-
for (i = 0; i < handle->q_num; i++)
hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
+
+ kfree(vf_cb);
}
static int hns_ae_wait_flow_down(struct hnae_handle *handle)
--
2.19.1
next prev parent reply other threads:[~2019-02-13 2:37 UTC|newest]
Thread overview: 83+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-13 2:35 [PATCH AUTOSEL 4.19 01/83] backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 02/83] mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 03/83] pvcalls-front: read all data before closing the connection Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 04/83] pvcalls-front: don't try to free unallocated rings Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 05/83] pvcalls-front: properly allocate sk Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 06/83] pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 07/83] mfd: twl-core: Fix section annotations on {,un}protect_pm_master Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 08/83] mfd: db8500-prcmu: Fix some section annotations Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 09/83] mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 10/83] mfd: ab8500-core: Return zero in get_register_interruptible() Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 11/83] mfd: bd9571mwv: Add volatile register to make DVFS work Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 12/83] mfd: qcom_rpm: write fw_version to CTRL_REG Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 13/83] mfd: wm5110: Add missing ASRC rate register Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 14/83] mfd: axp20x: Add AC power supply cell for AXP813 Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 15/83] mfd: axp20x: Re-align MFD cell entries Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 16/83] mfd: axp20x: Add supported cells for AXP803 Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 17/83] mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 18/83] mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe() Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 19/83] mfd: mc13xxx: Fix a missing check of a register-read failure Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 20/83] xen/pvcalls: remove set but not used variable 'intf' Sasha Levin
2019-02-13 2:35 ` [PATCH AUTOSEL 4.19 21/83] qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 22/83] qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier Sasha Levin
2019-02-13 2:36 ` Sasha Levin [this message]
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 24/83] bpf: Fix [::] -> [::1] rewrite in sys_sendmsg Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 25/83] selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in test_sock_addr Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 26/83] watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 27/83] net/mlx4: Get rid of page operation after dma_alloc_coherent Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 28/83] MIPS: ath79: Enable OF serial ports in the default config Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 29/83] xprtrdma: Double free in rpcrdma_sendctxs_create() Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 30/83] mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 31/83] selftests: forwarding: Add a test for VLAN deletion Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 32/83] netfilter: nf_tables: fix leaking object reference count Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 33/83] scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 34/83] scsi: isci: initialize shost fully before calling scsi_add_host() Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 35/83] include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 36/83] MIPS: jazz: fix 64bit build Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 37/83] netfilter: nft_flow_offload: Fix reverse route lookup Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 38/83] bpf: correctly set initial window on active Fast Open sender Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 39/83] pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 40/83] bpf: fix panic in stack_map_get_build_id() on i386 and arm32 Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 41/83] netfilter: nft_flow_offload: fix interaction with vrf slave device Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 42/83] RDMA/mthca: Clear QP objects during their allocation Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 43/83] powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 44/83] acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 45/83] net: stmmac: Fix PCI module removal leak Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 46/83] net: stmmac: dwxgmac2: Only clear interrupts that are active Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 47/83] net: stmmac: Check if CBS is supported before configuring Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 48/83] net: stmmac: Fix the logic of checking if RX Watchdog must be enabled Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 49/83] net: stmmac: Prevent RX starvation in stmmac_napi_poll() Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 50/83] isdn: i4l: isdn_tty: Fix some concurrency double-free bugs Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 51/83] scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 52/83] scsi: ufs: Fix system suspend status Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 53/83] scsi: qedi: Add ep_state for login completion on un-reachable targets Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 54/83] scsi: ufs: Fix geometry descriptor size Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 55/83] scsi: cxgb4i: add wait_for_completion() Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 56/83] netfilter: nft_flow_offload: fix checking method of conntrack helper Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 57/83] always clear the X2APIC_ENABLE bit for PV guest Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 58/83] drm/meson: add missing of_node_put Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 59/83] drm/amdkfd: Don't assign dGPUs to APU topology devices Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 60/83] drm/amd/display: fix PME notification not working in RV desktop Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 61/83] vhost: return EINVAL if iovecs size does not match the message size Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 62/83] drm/sun4i: backend: add missing of_node_puts Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 63/83] pvcalls-front: fix potential null dereference Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 64/83] selftests: tc-testing: drop test on missing tunnel key id Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 65/83] selftests: tc-testing: fix tunnel_key failure if dst_port is unspecified Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 66/83] selftests: tc-testing: fix parsing of ife type Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 67/83] PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 68/83] afs: Don't set vnode->cb_s_break in afs_validate() Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 69/83] afs: Fix key refcounting in file locking code Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 70/83] bpf: don't assume build-id length is always 20 bytes Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 71/83] bpf: zero out build_id for BPF_STACK_BUILD_ID_IP Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 72/83] selftests/bpf: retry tests that expect build-id Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 73/83] atm: he: fix sign-extension overflow on large shift Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 74/83] hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 75/83] leds: lp5523: fix a missing check of return value of lp55xx_read Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 76/83] bpf: bpf_setsockopt: reset sock dst on SO_MARK changes Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 77/83] dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 78/83] mlxsw: pci: Return error on PCI reset timeout Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 79/83] net: bridge: Mark FDB entries that were added by user as such Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 80/83] mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky Sasha Levin
2019-02-13 2:36 ` [PATCH AUTOSEL 4.19 81/83] selftests: forwarding: Add a test case for externally learned FDB entries Sasha Levin
2019-02-13 2:37 ` [PATCH AUTOSEL 4.19 82/83] net/mlx5e: Fix wrong (zero) TX drop counter indication for representor Sasha Levin
2019-02-13 2:37 ` [PATCH AUTOSEL 4.19 83/83] isdn: avm: Fix string plus integer warning from Clang Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190213023701.20286-23-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=liuyonglong@huawei.com \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tanhuazhong@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox