From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Yonglong Liu <liuyonglong@huawei.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 39/52] net: hns: Fix probabilistic memory overwrite when HNS driver initialized
Date: Wed, 24 Apr 2019 10:38:57 -0400 [thread overview]
Message-ID: <20190424143911.28890-39-sashal@kernel.org> (raw)
In-Reply-To: <20190424143911.28890-1-sashal@kernel.org>
From: Yonglong Liu <liuyonglong@huawei.com>
[ Upstream commit c0b0984426814f3a9251873b689e67d34d8ccd84 ]
When reboot the system again and again, may cause a memory
overwrite.
[ 15.638922] systemd[1]: Reached target Swap.
[ 15.667561] tun: Universal TUN/TAP device driver, 1.6
[ 15.676756] Bridge firewalling registered
[ 17.344135] Unable to handle kernel paging request at virtual address 0000000200000040
[ 17.352179] Mem abort info:
[ 17.355007] ESR = 0x96000004
[ 17.358105] Exception class = DABT (current EL), IL = 32 bits
[ 17.364112] SET = 0, FnV = 0
[ 17.367209] EA = 0, S1PTW = 0
[ 17.370393] Data abort info:
[ 17.373315] ISV = 0, ISS = 0x00000004
[ 17.377206] CM = 0, WnR = 0
[ 17.380214] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
[ 17.386926] [0000000200000040] pgd=0000000000000000
[ 17.391878] Internal error: Oops: 96000004 [#1] SMP
[ 17.396824] CPU: 23 PID: 95 Comm: kworker/u130:0 Tainted: G E 4.19.25-1.2.78.aarch64 #1
[ 17.414175] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.54 08/16/2018
[ 17.425615] Workqueue: events_unbound async_run_entry_fn
[ 17.435151] pstate: 00000005 (nzcv daif -PAN -UAO)
[ 17.444139] pc : __mutex_lock.isra.1+0x74/0x540
[ 17.453002] lr : __mutex_lock.isra.1+0x3c/0x540
[ 17.461701] sp : ffff000100d9bb60
[ 17.469146] x29: ffff000100d9bb60 x28: 0000000000000000
[ 17.478547] x27: 0000000000000000 x26: ffff802fb8945000
[ 17.488063] x25: 0000000000000000 x24: ffff802fa32081a8
[ 17.497381] x23: 0000000000000002 x22: ffff801fa2b15220
[ 17.506701] x21: ffff000009809000 x20: ffff802fa23a0888
[ 17.515980] x19: ffff801fa2b15220 x18: 0000000000000000
[ 17.525272] x17: 0000000200000000 x16: 0000000200000000
[ 17.534511] x15: 0000000000000000 x14: 0000000000000000
[ 17.543652] x13: ffff000008d95db8 x12: 000000000000000d
[ 17.552780] x11: ffff000008d95d90 x10: 0000000000000b00
[ 17.561819] x9 : ffff000100d9bb90 x8 : ffff802fb89d6560
[ 17.570829] x7 : 0000000000000004 x6 : 00000004a1801d05
[ 17.579839] x5 : 0000000000000000 x4 : 0000000000000000
[ 17.588852] x3 : ffff802fb89d5a00 x2 : 0000000000000000
[ 17.597734] x1 : 0000000200000000 x0 : 0000000200000000
[ 17.606631] Process kworker/u130:0 (pid: 95, stack limit = 0x(____ptrval____))
[ 17.617438] Call trace:
[ 17.623349] __mutex_lock.isra.1+0x74/0x540
[ 17.630927] __mutex_lock_slowpath+0x24/0x30
[ 17.638602] mutex_lock+0x50/0x60
[ 17.645295] drain_workqueue+0x34/0x198
[ 17.652623] __sas_drain_work+0x7c/0x168
[ 17.659903] sas_drain_work+0x60/0x68
[ 17.666947] hisi_sas_scan_finished+0x30/0x40 [hisi_sas_main]
[ 17.676129] do_scsi_scan_host+0x70/0xb0
[ 17.683534] do_scan_async+0x20/0x228
[ 17.690586] async_run_entry_fn+0x4c/0x1d0
[ 17.697997] process_one_work+0x1b4/0x3f8
[ 17.705296] worker_thread+0x54/0x470
Every time the call trace is not the same, but the overwrite address
is always the same:
Unable to handle kernel paging request at virtual address 0000000200000040
The root cause is, when write the reg XGMAC_MAC_TX_LF_RF_CONTROL_REG,
didn't use the io_base offset.
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
index ba4316910dea..a60f207768fc 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c
@@ -129,7 +129,7 @@ static void hns_xgmac_lf_rf_control_init(struct mac_driver *mac_drv)
dsaf_set_bit(val, XGMAC_UNIDIR_EN_B, 0);
dsaf_set_bit(val, XGMAC_RF_TX_EN_B, 1);
dsaf_set_field(val, XGMAC_LF_RF_INSERT_M, XGMAC_LF_RF_INSERT_S, 0);
- dsaf_write_reg(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
+ dsaf_write_dev(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val);
}
/**
--
2.19.1
next prev parent reply other threads:[~2019-04-24 14:42 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-24 14:38 [PATCH AUTOSEL 4.19 01/52] arm64: dts: rockchip: fix rk3328-roc-cc gmac2io tx/rx_delay Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 02/52] HID: logitech: check the return value of create_singlethread_workqueue Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 03/52] HID: debug: fix race condition with between rdesc_show() and device removal Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 04/52] rtc: cros-ec: Fail suspend/resume if wake IRQ can't be configured Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 05/52] rtc: sh: Fix invalid alarm warning for non-enabled alarm Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 06/52] batman-adv: Reduce claim hash refcnt only for removed entry Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 07/52] batman-adv: Reduce tt_local " Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 08/52] batman-adv: Reduce tt_global " Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 09/52] batman-adv: fix warning in function batadv_v_elp_get_throughput Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 10/52] ARM: dts: rockchip: Fix gpu opp node names for rk3288 Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 11/52] reset: meson-audio-arb: Fix missing .owner setting of reset_controller_dev Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 12/52] igb: Fix WARN_ONCE on runtime suspend Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 13/52] fm10k: Fix a potential NULL pointer dereference Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 14/52] riscv: fix accessing 8-byte variable from RV32 Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 15/52] HID: quirks: Fix keyboard + touchpad on Lenovo Miix 630 Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 16/52] net: hns3: fix compile error Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 17/52] net/mlx5: E-Switch, Fix esw manager vport indication for more vport commands Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 18/52] bonding: show full hw address in sysfs for slave entries Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 19/52] net: stmmac: use correct DMA buffer size in the RX descriptor Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 20/52] net: stmmac: ratelimit RX error logs Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 21/52] net: stmmac: don't stop NAPI processing when dropping a packet Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 22/52] net: stmmac: don't overwrite discard_frame status Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 23/52] net: stmmac: fix dropping of multi-descriptor RX frames Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 24/52] net: stmmac: don't log oversized frames Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 25/52] jffs2: fix use-after-free on symlink traversal Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 26/52] debugfs: " Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 27/52] mfd: twl-core: Disable IRQ while suspended Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 28/52] block: use blk_free_flush_queue() to free hctx->fq in blk_mq_init_hctx Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 29/52] rtc: da9063: set uie_unsupported when relevant Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 30/52] HID: input: add mapping for Assistant key Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 31/52] vfio/pci: use correct format characters Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 32/52] vfio/type1: Limit DMA mappings per container Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 33/52] scsi: core: add new RDAC LENOVO/DE_Series device Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 34/52] scsi: storvsc: Fix calculation of sub-channel count Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 35/52] arm/mach-at91/pm : fix possible object reference leak Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 36/52] arm64: fix wrong check of on_sdei_stack in nmi context Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 37/52] net: hns: fix KASAN: use-after-free in hns_nic_net_xmit_hw() Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 38/52] net: hns: Use NAPI_POLL_WEIGHT for hns driver Sasha Levin
2019-04-24 14:38 ` Sasha Levin [this message]
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 40/52] net: hns: fix ICMP6 neighbor solicitation messages discard problem Sasha Levin
2019-04-24 14:38 ` [PATCH AUTOSEL 4.19 41/52] net: hns: Fix WARNING when remove HNS driver with SMMU enabled Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 42/52] libcxgb: fix incorrect ppmax calculation Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 43/52] KVM: SVM: prevent DBG_DECRYPT and DBG_ENCRYPT overflow Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 44/52] kmemleak: powerpc: skip scanning holes in the .bss section Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 45/52] hugetlbfs: fix memory leak for resv_map Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 46/52] sh: fix multiple function definition build errors Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 47/52] kernel/sysctl.c: fix out-of-bounds access when setting file-max Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 48/52] xsysace: Fix error handling in ace_setup Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 49/52] fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock Sasha Levin
2019-04-24 16:34 ` Greg Kroah-Hartman
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 50/52] ARM: orion: don't use using 64-bit DMA masks Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 51/52] ARM: iop: " Sasha Levin
2019-04-24 14:39 ` [PATCH AUTOSEL 4.19 52/52] aio: fold lookup_kiocb() into its sole caller Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190424143911.28890-39-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=liuyonglong@huawei.com \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).