From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Manish Chopra <manishc@marvell.com>,
Ariel Elior <aelior@marvell.com>,
Sudarsana Kalluru <skalluru@marvell.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 08/65] qede: fix NULL pointer deref in __qede_remove()
Date: Mon, 11 Nov 2019 19:28:08 +0100 [thread overview]
Message-ID: <20191111181336.949896899@linuxfoundation.org> (raw)
In-Reply-To: <20191111181331.917659011@linuxfoundation.org>
From: Manish Chopra <manishc@marvell.com>
[ Upstream commit deabc87111c690097c03765ea017cd500f7376fc ]
While rebooting the system with SR-IOV vfs enabled leads
to below crash due to recurrence of __qede_remove() on the VF
devices (first from .shutdown() flow of the VF itself and
another from PF's .shutdown() flow executing pci_disable_sriov())
This patch adds a safeguard in __qede_remove() flow to fix this,
so that driver doesn't attempt to remove "already removed" devices.
[ 194.360134] BUG: unable to handle kernel NULL pointer dereference at 00000000000008dc
[ 194.360227] IP: [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede]
[ 194.360304] PGD 0
[ 194.360325] Oops: 0000 [#1] SMP
[ 194.360360] Modules linked in: tcp_lp fuse tun bridge stp llc devlink bonding ip_set nfnetlink ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib ib_umad rpcrdma sunrpc rdma_ucm ib_uverbs ib_iser rdma_cm iw_cm ib_cm libiscsi scsi_transport_iscsi dell_smbios iTCO_wdt iTCO_vendor_support dell_wmi_descriptor dcdbas vfat fat pcc_cpufreq skx_edac intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd qedr ib_core pcspkr ses enclosure joydev ipmi_ssif sg i2c_i801 lpc_ich mei_me mei wmi ipmi_si ipmi_devintf ipmi_msghandler tpm_crb acpi_pad acpi_power_meter xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_pclmul crct10dif_common crc32c_intel mgag200
[ 194.361044] qede i2c_algo_bit drm_kms_helper qed syscopyarea sysfillrect nvme sysimgblt fb_sys_fops ttm nvme_core mpt3sas crc8 ptp drm pps_core ahci raid_class scsi_transport_sas libahci libata drm_panel_orientation_quirks nfit libnvdimm dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ip_tables]
[ 194.361297] CPU: 51 PID: 7996 Comm: reboot Kdump: loaded Not tainted 3.10.0-1062.el7.x86_64 #1
[ 194.361359] Hardware name: Dell Inc. PowerEdge MX840c/0740HW, BIOS 2.4.6 10/15/2019
[ 194.361412] task: ffff9cea9b360000 ti: ffff9ceabebdc000 task.ti: ffff9ceabebdc000
[ 194.361463] RIP: 0010:[<ffffffffc03553c4>] [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede]
[ 194.361534] RSP: 0018:ffff9ceabebdfac0 EFLAGS: 00010282
[ 194.361570] RAX: 0000000000000000 RBX: ffff9cd013846098 RCX: 0000000000000000
[ 194.361621] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9cd013846098
[ 194.361668] RBP: ffff9ceabebdfae8 R08: 0000000000000000 R09: 0000000000000000
[ 194.361715] R10: 00000000bfe14201 R11: ffff9ceabfe141e0 R12: 0000000000000000
[ 194.361762] R13: ffff9cd013846098 R14: 0000000000000000 R15: ffff9ceab5e48000
[ 194.361810] FS: 00007f799c02d880(0000) GS:ffff9ceacb0c0000(0000) knlGS:0000000000000000
[ 194.361865] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 194.361903] CR2: 00000000000008dc CR3: 0000001bdac76000 CR4: 00000000007607e0
[ 194.361953] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 194.362002] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 194.362051] PKRU: 55555554
[ 194.362073] Call Trace:
[ 194.362109] [<ffffffffc0355500>] qede_remove+0x10/0x20 [qede]
[ 194.362180] [<ffffffffb97d0f3e>] pci_device_remove+0x3e/0xc0
[ 194.362240] [<ffffffffb98b3c52>] __device_release_driver+0x82/0xf0
[ 194.362285] [<ffffffffb98b3ce3>] device_release_driver+0x23/0x30
[ 194.362343] [<ffffffffb97c86d4>] pci_stop_bus_device+0x84/0xa0
[ 194.362388] [<ffffffffb97c87e2>] pci_stop_and_remove_bus_device+0x12/0x20
[ 194.362450] [<ffffffffb97f153f>] pci_iov_remove_virtfn+0xaf/0x160
[ 194.362496] [<ffffffffb97f1aec>] sriov_disable+0x3c/0xf0
[ 194.362534] [<ffffffffb97f1bc3>] pci_disable_sriov+0x23/0x30
[ 194.362599] [<ffffffffc02f83c3>] qed_sriov_disable+0x5e3/0x650 [qed]
[ 194.362658] [<ffffffffb9622df6>] ? kfree+0x106/0x140
[ 194.362709] [<ffffffffc02cc0c0>] ? qed_free_stream_mem+0x70/0x90 [qed]
[ 194.362754] [<ffffffffb9622df6>] ? kfree+0x106/0x140
[ 194.362803] [<ffffffffc02cd659>] qed_slowpath_stop+0x1a9/0x1d0 [qed]
[ 194.362854] [<ffffffffc035544e>] __qede_remove+0xae/0x130 [qede]
[ 194.362904] [<ffffffffc03554e0>] qede_shutdown+0x10/0x20 [qede]
[ 194.362956] [<ffffffffb97cf90a>] pci_device_shutdown+0x3a/0x60
[ 194.363010] [<ffffffffb98b180b>] device_shutdown+0xfb/0x1f0
[ 194.363066] [<ffffffffb94b66c6>] kernel_restart_prepare+0x36/0x40
[ 194.363107] [<ffffffffb94b66e2>] kernel_restart+0x12/0x60
[ 194.363146] [<ffffffffb94b6959>] SYSC_reboot+0x229/0x260
[ 194.363196] [<ffffffffb95f200d>] ? handle_mm_fault+0x39d/0x9b0
[ 194.363253] [<ffffffffb942b621>] ? __switch_to+0x151/0x580
[ 194.363304] [<ffffffffb9b7ec28>] ? __schedule+0x448/0x9c0
[ 194.363343] [<ffffffffb94b69fe>] SyS_reboot+0xe/0x10
[ 194.363387] [<ffffffffb9b8bede>] system_call_fastpath+0x25/0x2a
[ 194.363430] Code: f9 e9 37 ff ff ff 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 4c 8d af 98 00 00 00 41 54 4c 89 ef 41 89 f4 53 e8 4c e4 55 f9 <80> b8 dc 08 00 00 01 48 89 c3 4c 8d b8 c0 08 00 00 4c 8b b0 c0
[ 194.363712] RIP [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede]
[ 194.363764] RSP <ffff9ceabebdfac0>
[ 194.363791] CR2: 00000000000008dc
Signed-off-by: Manish Chopra <manishc@marvell.com>
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Sudarsana Kalluru <skalluru@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qede/qede_main.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -2619,8 +2619,16 @@ enum qede_remove_mode {
static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode)
{
struct net_device *ndev = pci_get_drvdata(pdev);
- struct qede_dev *edev = netdev_priv(ndev);
- struct qed_dev *cdev = edev->cdev;
+ struct qede_dev *edev;
+ struct qed_dev *cdev;
+
+ if (!ndev) {
+ dev_info(&pdev->dev, "Device has already been removed\n");
+ return;
+ }
+
+ edev = netdev_priv(ndev);
+ cdev = edev->cdev;
DP_INFO(edev, "Starting qede_remove\n");
next prev parent reply other threads:[~2019-11-11 18:32 UTC|newest]
Thread overview: 71+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-11 18:28 [PATCH 4.9 00/65] 4.9.201-stable review Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 01/65] CDC-NCM: handle incomplete transfer of MTU Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 02/65] ipv4: Fix table id reference in fib_sync_down_addr Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 03/65] net: fix data-race in neigh_event_send() Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 04/65] net: usb: qmi_wwan: add support for DW5821e with eSIM support Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 05/65] NFC: fdp: fix incorrect free object Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 06/65] nfc: netlink: fix double device reference drop Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 07/65] NFC: st21nfca: fix double free Greg Kroah-Hartman
2019-11-11 18:28 ` Greg Kroah-Hartman [this message]
2019-11-11 18:28 ` [PATCH 4.9 09/65] ALSA: timer: Fix incorrectly assigned timer instance Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 10/65] ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 11/65] ALSA: hda/ca0132 - Fix possible workqueue stall Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 12/65] mm, meminit: recalculate pcpu batch and high limits after init completes Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 13/65] mm: thp: handle page cache THP correctly in PageTransCompoundMap Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 14/65] mm, vmstat: hide /proc/pagetypeinfo from normal users Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 15/65] dump_stack: avoid the livelock of the dump_lock Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 16/65] perf tools: Fix time sorting Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 17/65] drm/radeon: fix si_enable_smc_cac() failed issue Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 18/65] ceph: fix use-after-free in __ceph_remove_cap() Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 19/65] iio: imu: adis16480: make sure provided frequency is positive Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 20/65] netfilter: nf_tables: Align nft_expr private data to 64-bit Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 21/65] netfilter: ipset: Fix an error code in ip_set_sockfn_get() Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 22/65] can: usb_8dev: fix use-after-free on disconnect Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 23/65] can: c_can: c_can_poll(): only read status register after status IRQ Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 24/65] can: peak_usb: fix a potential out-of-sync while decoding packets Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 25/65] can: gs_usb: gs_can_open(): prevent memory leak Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 26/65] can: peak_usb: fix slab info leak Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 27/65] configfs: Fix bool initialization/comparison Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 28/65] configfs: stash the data we need into configfs_buffer at open time Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 29/65] configfs_register_group() shouldnt be (and isnt) called in rmdirable parts Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 30/65] configfs: new object reprsenting tree fragments Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 31/65] configfs: provide exclusion between IO and removals Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 32/65] configfs: fix a deadlock in configfs_symlink() Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 33/65] usbip: stub_rx: fix static checker warning on unnecessary checks Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 34/65] usbip: Fix vhci_urb_enqueue() URB null transfer buffer error path Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 35/65] usbip: fix possibility of dereference by NULLL pointer in vhci_hcd.c Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 36/65] drivers: usb: usbip: Add missing break statement to switch Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 37/65] PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30 Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 38/65] dmaengine: xilinx_dma: Fix control reg update in vdma_channel_set_config Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 39/65] HID: intel-ish-hid: fix wrong error handling in ishtp_cl_alloc_tx_ring() Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 40/65] scsi: qla2xxx: fixup incorrect usage of host_byte Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 41/65] scsi: lpfc: Honor module parameter lpfc_use_adisc Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 42/65] ipvs: move old_secure_tcp into struct netns_ipvs Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 43/65] bonding: fix unexpected IFF_BONDING bit unset Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 44/65] usb: fsl: Check memory resource before releasing it Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 45/65] usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 46/65] usb: gadget: composite: Fix possible double free memory bug Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 47/65] usb: gadget: configfs: fix concurrent issue between composite APIs Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 48/65] usb: dwc3: remove the call trace of USBx_GFLADJ Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 49/65] perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise RIP validity Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 50/65] perf/x86/amd/ibs: Handle erratum #420 only on the affected CPU family (10h) Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 51/65] USB: Skip endpoints with 0 maxpacket length Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 52/65] RDMA/iw_cxgb4: Avoid freeing skb twice in arp failure case Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 53/65] scsi: qla2xxx: stop timer in shutdown path Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 54/65] fjes: Handle workqueue allocation failure Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 55/65] net: hisilicon: Fix "Trying to free already-free IRQ" Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 56/65] NFSv4: Dont allow a cached open with a revoked delegation Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 57/65] net: ethernet: arc: add the missed clk_disable_unprepare Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 58/65] igb: Fix constant media auto sense switching when no cable is connected Greg Kroah-Hartman
2019-11-11 18:28 ` [PATCH 4.9 59/65] e1000: fix memory leaks Greg Kroah-Hartman
2019-11-11 18:29 ` [PATCH 4.9 60/65] x86/apic: Move pending interrupt check code into its own function Greg Kroah-Hartman
2019-11-11 18:29 ` [PATCH 4.9 61/65] x86/apic: Drop logical_smp_processor_id() inline Greg Kroah-Hartman
2019-11-11 18:29 ` [PATCH 4.9 62/65] x86/apic/32: Avoid bogus LDR warnings Greg Kroah-Hartman
2019-11-11 18:29 ` [PATCH 4.9 63/65] can: flexcan: disable completely the ECC mechanism Greg Kroah-Hartman
2019-11-11 18:29 ` [PATCH 4.9 64/65] mm/filemap.c: dont initiate writeback if mapping has no dirty pages Greg Kroah-Hartman
2019-11-11 18:29 ` [PATCH 4.9 65/65] cgroup,writeback: dont switch wbs immediately on dead wbs if the memcg is dead Greg Kroah-Hartman
2019-11-12 0:38 ` [PATCH 4.9 00/65] 4.9.201-stable review kernelci.org bot
2019-11-12 5:27 ` Greg Kroah-Hartman
2019-11-12 12:00 ` Jon Hunter
2019-11-12 13:24 ` Naresh Kamboju
2019-11-12 18:19 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191111181336.949896899@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aelior@marvell.com \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=manishc@marvell.com \
--cc=skalluru@marvell.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®