From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr690117.outbound.protection.outlook.com ([40.107.69.117]:44672 "EHLO NAM04-CO1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729103AbeJAHOM (ORCPT ); Mon, 1 Oct 2018 03:14:12 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Netanel Belgazal , "David S . Miller" , Sasha Levin Subject: [PATCH AUTOSEL 4.18 40/65] net: ena: fix surprise unplug NULL dereference kernel crash Date: Mon, 1 Oct 2018 00:38:27 +0000 Message-ID: <20181001003754.146961-40-alexander.levin@microsoft.com> References: <20181001003754.146961-1-alexander.levin@microsoft.com> In-Reply-To: <20181001003754.146961-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Netanel Belgazal [ Upstream commit 772ed869f535b4ec2b134645c951ff22de4d3f79 ] Starting with driver version 1.5.0, in case of a surprise device unplug, there is a race caused by invoking ena_destroy_device() from two different places. As a result, the readless register might be accessed after it was destroyed. Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/eth= ernet/amazon/ena/ena_netdev.c index f2af87d70594..26686a21234e 100644 --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -3408,12 +3408,12 @@ static void ena_remove(struct pci_dev *pdev) netdev->rx_cpu_rmap =3D NULL; } #endif /* CONFIG_RFS_ACCEL */ - - unregister_netdev(netdev); del_timer_sync(&adapter->timer_service); =20 cancel_work_sync(&adapter->reset_task); =20 + unregister_netdev(netdev); + /* Reset the device only if the device is running. */ if (test_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags)) ena_com_dev_reset(ena_dev, adapter->reset_reason); --=20 2.17.1