From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Tong Zhang <ztong0001@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.19 04/72] atm: lanai: dont run lanai_dev_close if not open
Date: Mon, 29 Mar 2021 09:57:40 +0200 [thread overview]
Message-ID: <20210329075610.440834483@linuxfoundation.org> (raw)
In-Reply-To: <20210329075610.300795746@linuxfoundation.org>
From: Tong Zhang <ztong0001@gmail.com>
[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ]
lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the
pci device is disabled. The caller, lanai_init_one(), then tries to run
atm_dev_deregister(). This will subsequently call lanai_dev_close() and
use the already released MMIO area.
To fix this issue, set the lanai->base to NULL if open fail,
and test the flag in lanai_dev_close().
[ 8.324153] lanai: lanai_start() failed, err=19
[ 8.324819] lanai(itf 0): shutting down interface
[ 8.325211] BUG: unable to handle page fault for address: ffffc90000180024
[ 8.325781] #PF: supervisor write access in kernel mode
[ 8.326215] #PF: error_code(0x0002) - not-present page
[ 8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0
[ 8.327206] Oops: 0002 [#1] SMP KASAN NOPTI
[ 8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12
[ 8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4
[ 8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
[ 8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
[ 8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
[ 8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
[ 8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
[ 8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
[ 8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
[ 8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
[ 8.333077] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
[ 8.333502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
[ 8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.334932] Call Trace:
[ 8.335066] atm_dev_deregister+0x161/0x1a0 [atm]
[ 8.335324] lanai_init_one.cold+0x20c/0x96d [lanai]
[ 8.335594] ? lanai_send+0x2a0/0x2a0 [lanai]
[ 8.335831] local_pci_probe+0x6f/0xb0
[ 8.336039] pci_device_probe+0x171/0x240
[ 8.336255] ? pci_device_remove+0xe0/0xe0
[ 8.336475] ? kernfs_create_link+0xb6/0x110
[ 8.336704] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
[ 8.336983] really_probe+0x161/0x420
[ 8.337181] driver_probe_device+0x6d/0xd0
[ 8.337401] device_driver_attach+0x82/0x90
[ 8.337626] ? device_driver_attach+0x90/0x90
[ 8.337859] __driver_attach+0x60/0x100
[ 8.338065] ? device_driver_attach+0x90/0x90
[ 8.338298] bus_for_each_dev+0xe1/0x140
[ 8.338511] ? subsys_dev_iter_exit+0x10/0x10
[ 8.338745] ? klist_node_init+0x61/0x80
[ 8.338956] bus_add_driver+0x254/0x2a0
[ 8.339164] driver_register+0xd3/0x150
[ 8.339370] ? 0xffffffffc0028000
[ 8.339550] do_one_initcall+0x84/0x250
[ 8.339755] ? trace_event_raw_event_initcall_finish+0x150/0x150
[ 8.340076] ? free_vmap_area_noflush+0x1a5/0x5c0
[ 8.340329] ? unpoison_range+0xf/0x30
[ 8.340532] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[ 8.340806] ? unpoison_range+0xf/0x30
[ 8.341014] ? unpoison_range+0xf/0x30
[ 8.341217] do_init_module+0xf8/0x350
[ 8.341419] load_module+0x3fe6/0x4340
[ 8.341621] ? vm_unmap_ram+0x1d0/0x1d0
[ 8.341826] ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[ 8.342101] ? module_frob_arch_sections+0x20/0x20
[ 8.342358] ? __do_sys_finit_module+0x108/0x170
[ 8.342604] __do_sys_finit_module+0x108/0x170
[ 8.342841] ? __ia32_sys_init_module+0x40/0x40
[ 8.343083] ? file_open_root+0x200/0x200
[ 8.343298] ? do_sys_open+0x85/0xe0
[ 8.343491] ? filp_open+0x50/0x50
[ 8.343675] ? exit_to_user_mode_prepare+0xfc/0x130
[ 8.343935] do_syscall_64+0x33/0x40
[ 8.344132] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 8.344401] RIP: 0033:0x7f08eb887cf7
[ 8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41
[ 8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7
[ 8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003
[ 8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
[ 8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0
[ 8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001
[ 8.347836] Modules linked in: lanai(+) atm
[ 8.348065] CR2: ffffc90000180024
[ 8.348244] ---[ end trace 7fdc1c668f2003e5 ]---
[ 8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai]
[ 8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80
[ 8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246
[ 8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a
[ 8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000
[ 8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa
[ 8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4
[ 8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88
[ 8.351918] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000
[ 8.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0
[ 8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8.353958] modprobe (95) used greatest stack depth: 26216 bytes left
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/atm/lanai.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
index 5f8e009b2da1..34e6e4b90f74 100644
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@@ -2238,6 +2238,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)
conf1_write(lanai);
#endif
iounmap(lanai->base);
+ lanai->base = NULL;
error_pci:
pci_disable_device(lanai->pci);
error:
@@ -2250,6 +2251,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)
static void lanai_dev_close(struct atm_dev *atmdev)
{
struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data;
+ if (lanai->base==NULL)
+ return;
printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n",
lanai->number);
lanai_timed_poll_stop(lanai);
@@ -2559,7 +2562,7 @@ static int lanai_init_one(struct pci_dev *pci,
struct atm_dev *atmdev;
int result;
- lanai = kmalloc(sizeof(*lanai), GFP_KERNEL);
+ lanai = kzalloc(sizeof(*lanai), GFP_KERNEL);
if (lanai == NULL) {
printk(KERN_ERR DEV_LABEL
": couldn't allocate dev_data structure!\n");
--
2.30.1
next prev parent reply other threads:[~2021-03-29 8:14 UTC|newest]
Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-29 7:57 [PATCH 4.19 00/72] 4.19.184-rc1 review Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 01/72] net: fec: ptp: avoid register access when ipg clock is disabled Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 02/72] powerpc/4xx: Fix build errors from mfdcr() Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 03/72] atm: eni: dont release is never initialized Greg Kroah-Hartman
2021-03-29 7:57 ` Greg Kroah-Hartman [this message]
2021-03-29 7:57 ` [PATCH 4.19 05/72] Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 06/72] ixgbe: Fix memleak in ixgbe_configure_clsu32 Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 07/72] net: tehuti: fix error return code in bdx_probe() Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 08/72] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 09/72] gianfar: fix jumbo packets+napi+rx overrun crash Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 10/72] gpiolib: acpi: Add missing IRQF_ONESHOT Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 11/72] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 12/72] NFS: Correct size calculation for create reply length Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 13/72] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 14/72] net: wan: fix error return code of uhdlc_init() Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 15/72] atm: uPD98402: fix incorrect allocation Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 16/72] atm: idt77252: fix null-ptr-dereference Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 17/72] sparc64: Fix opcode filtering in handling of no fault loads Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 18/72] u64_stats,lockdep: Fix u64_stats_init() vs lockdep Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 19/72] drm/radeon: fix AGP dependency Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 20/72] nfs: we dont support removing system.nfs4_acl Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 21/72] block: Suppress uevent for hidden device when removed Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 22/72] ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls Greg Kroah-Hartman
2021-03-29 7:57 ` [PATCH 4.19 23/72] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 24/72] netsec: restore phy power state after controller reset Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 25/72] platform/x86: intel-vbtn: Stop reporting SW_DOCK events Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 26/72] squashfs: fix inode lookup sanity checks Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 27/72] squashfs: fix xattr id and id " Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 28/72] arm64: dts: ls1046a: mark crypto engine dma coherent Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 29/72] arm64: dts: ls1012a: " Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 30/72] arm64: dts: ls1043a: " Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 31/72] ARM: dts: at91-sama5d27_som1: fix phy address to 7 Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 32/72] dm ioctl: fix out of bounds array access when no devices Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 33/72] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 34/72] veth: Store queue_mapping independently of XDP prog presence Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 35/72] libbpf: Fix INSTALL flag order Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 36/72] macvlan: macvlan_count_rx() needs to be aware of preemption Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 37/72] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 38/72] e1000e: add rtnl_lock() to e1000_reset_task Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 39/72] e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 40/72] net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 41/72] ftgmac100: Restart MAC HW once Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 42/72] netfilter: ctnetlink: fix dump of the expect mask attribute Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 43/72] can: peak_usb: add forgotten supported devices Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 44/72] can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 45/72] can: c_can_pci: c_can_pci_remove(): fix use-after-free Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 46/72] can: c_can: move runtime PM enable/disable to c_can_platform Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 47/72] can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 48/72] mac80211: fix rate mask reset Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 49/72] net: cdc-phonet: fix data-interface release on probe failure Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 50/72] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 51/72] drm/msm: fix shutdown hook in case GPU components failed to bind Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 52/72] arm64: kdump: update ppos when reading elfcorehdr Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 53/72] net/mlx5e: Fix error path for ethtool set-priv-flag Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 54/72] RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 55/72] bpf: Dont do bpf_cgroup_storage_set() for kuprobe/tp programs Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 56/72] Revert "netfilter: x_tables: Switch synchronization to RCU" Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 57/72] netfilter: x_tables: Use correct memory barriers Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 58/72] Revert "netfilter: x_tables: Update remaining dereference to RCU" Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 59/72] ACPI: scan: Rearrange memory allocation in acpi_device_add() Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 60/72] ACPI: scan: Use unique number for instance_no Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 61/72] dm verity: add root hash pkcs#7 signature verification Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 62/72] perf auxtrace: Fix auxtrace queue conflict Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 63/72] scsi: qedi: Fix error return code of qedi_alloc_global_queues() Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 64/72] scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 65/72] locking/mutex: Fix non debug version of mutex_lock_io_nested() Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 66/72] x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 67/72] can: dev: Move device back to init netns on owning netns delete Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 68/72] net: sched: validate stab values Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 69/72] net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 70/72] mac80211: fix double free in ibss_leave Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 71/72] ext4: add reclaim checks to xattr code Greg Kroah-Hartman
2021-03-29 7:58 ` [PATCH 4.19 72/72] can: peak_usb: Revert "can: peak_usb: add forgotten supported devices" Greg Kroah-Hartman
2021-03-29 21:33 ` [PATCH 4.19 00/72] 4.19.184-rc1 review Guenter Roeck
2021-03-30 1:27 ` Shuah Khan
2021-03-30 6:52 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210329075610.440834483@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=ztong0001@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®