public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-04 00:06:36 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/drivers/net/ethernet/intel/ixgbe
History
Daniel Borkmann b5b2ffc057 ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe 
While working on a different issue, I noticed an annoying use
after free bug on my machine when unloading the ixgbe driver:

[ 8642.318797] ixgbe 0000:02:00.1: removed PHC on p2p2
[ 8642.742716] ixgbe 0000:02:00.1: complete
[ 8642.743784] BUG: unable to handle kernel paging request at ffff8807d3740a90
[ 8642.744828] IP: [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe]
[ 8642.745886] PGD 20c6067 PUD 81c1f6067 PMD 81c15a067 PTE 80000007d3740060
[ 8642.746956] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[ 8642.748039] Modules linked in: [...]
[ 8642.752929] CPU: 1 PID: 1225 Comm: rmmod Not tainted 3.18.0-rc2+ #49
[ 8642.754203] Hardware name: Supermicro X10SLM-F/X10SLM-F, BIOS 1.1b 11/01/2013
[ 8642.755505] task: ffff8807e34d3fe0 ti: ffff8807b7204000 task.ti: ffff8807b7204000
[ 8642.756831] RIP: 0010:[<ffffffffa01c77dc>]  [<ffffffffa01c77dc>] ixgbe_remove+0xfc/0x1b0 [ixgbe]
[...]
[ 8642.774335] Stack:
[ 8642.775805]  ffff8807ee824098 ffff8807ee824098 ffffffffa01f3000 ffff8807ee824000
[ 8642.777326]  ffff8807b7207e18 ffffffff8137720f ffff8807ee824098 ffff8807ee824098
[ 8642.778848]  ffffffffa01f3068 ffff8807ee8240f8 ffff8807b7207e38 ffffffff8144180f
[ 8642.780365] Call Trace:
[ 8642.781869]  [<ffffffff8137720f>] pci_device_remove+0x3f/0xc0
[ 8642.783395]  [<ffffffff8144180f>] __device_release_driver+0x7f/0xf0
[ 8642.784876]  [<ffffffff814421f8>] driver_detach+0xb8/0xc0
[ 8642.786352]  [<ffffffff814414a9>] bus_remove_driver+0x59/0xe0
[ 8642.787783]  [<ffffffff814429d0>] driver_unregister+0x30/0x70
[ 8642.789202]  [<ffffffff81375c65>] pci_unregister_driver+0x25/0xa0
[ 8642.790657]  [<ffffffffa01eb38e>] ixgbe_exit_module+0x1c/0xc8e [ixgbe]
[ 8642.792064]  [<ffffffff810f93a2>] SyS_delete_module+0x132/0x1c0
[ 8642.793450]  [<ffffffff81012c61>] ? do_notify_resume+0x61/0xa0
[ 8642.794837]  [<ffffffff816d2029>] system_call_fastpath+0x12/0x17

The issue is that test_and_set_bit() done on adapter->state is being
performed *after* the netdevice has been freed via free_netdev().

When netdev is being allocated on initialization time, it allocates
a private area, here struct ixgbe_adapter, that resides after the
net_device structure. In ixgbe_probe(), the device init routine,
we set up the adapter after alloc_etherdev_mq() on the private area
and add a reference for the pci_dev as well via pci_set_drvdata().

Both in the error path of ixgbe_probe(), but also on module unload
when ixgbe_remove() is being called, commit 41c62843eb ("ixgbe:
Fix rcu warnings induced by LER") accesses adapter after free_netdev().
The patch stores the result in a bool and thus fixes above oops on my
side.

Fixes: 41c62843eb ("ixgbe: Fix rcu warnings induced by LER")
Cc: stable <stable@vger.kernel.org>
Cc: Mark Rustad <mark.d.rustad@intel.com>
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-11-23 14:26:12 -05:00
..
ixgbe.h ixgbe: delete one duplicate marcro definition of IXGBE_MAX_L2A_QUEUES 2014-10-02 02:24:08 -07:00
ixgbe_82598.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
ixgbe_82599.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
ixgbe_common.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
ixgbe_common.h ixgbe: clean up checkpatch warnings about CODE_INDENT and LEADING_SPACE 2014-05-23 05:24:04 -07:00
ixgbe_dcb.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
ixgbe_dcb.h
ixgbe_dcb_82598.c ixgbe: convert low_water into an array 2014-04-22 23:07:11 -07:00
ixgbe_dcb_82598.h
ixgbe_dcb_82599.c ixgbe: convert low_water into an array 2014-04-22 23:07:11 -07:00
ixgbe_dcb_82599.h ixgbe: clean up checkpatch warnings about CODE_INDENT and LEADING_SPACE 2014-05-23 05:24:04 -07:00
ixgbe_dcb_nl.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
ixgbe_debugfs.c ixgbe: don't check NULL for debugfs_remove_recursive 2014-05-23 05:28:24 -07:00
ixgbe_ethtool.c ixgbe: fix race when setting advertised speed 2014-10-30 05:12:07 -07:00
ixgbe_fcoe.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
ixgbe_fcoe.h ixgbe: convert low_water into an array 2014-04-22 23:07:11 -07:00
ixgbe_lib.c ixgbe: add warnings for other disabled features without MSI-X support 2014-09-18 04:42:48 -07:00
ixgbe_main.c ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe 2014-11-23 14:26:12 -05:00
ixgbe_mbx.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
ixgbe_mbx.h ixgbe: clean up checkpatch warnings about CODE_INDENT and LEADING_SPACE 2014-05-23 05:24:04 -07:00
ixgbe_phy.c ixgbe: phy: fix uninitialized status in ixgbe_setup_phy_link_tnx 2014-11-11 16:31:54 -05:00
ixgbe_phy.h ixgbe: clean up checkpatch warnings about CODE_INDENT and LEADING_SPACE 2014-05-23 05:24:04 -07:00
ixgbe_ptp.c ixgbe: change PTP NSECS_PER_SEC to IXGBE_PTP_PPS_HALF_SECOND 2014-07-01 02:48:39 -07:00
ixgbe_sriov.c ixgbe: check for vfs outside of sriov_num_vfs before dereference 2014-10-16 02:21:03 -07:00
ixgbe_sriov.h net-next:v4: Add support to configure SR-IOV VF minimum and maximum Tx rate through ip tool. 2014-05-23 15:04:02 -04:00
ixgbe_sysfs.c ixgbe: add Linux NICS mailing list to contact info 2014-03-12 19:05:30 -07:00
ixgbe_type.h ixgbe: reset interface on link loss with pending Tx work from the VF 2014-09-04 01:38:32 -07:00
ixgbe_x540.c ixgbe: Make return values more direct 2014-07-25 19:58:36 -07:00
Makefile