Manish Chopra 9025d23cfc qede: fix NULL pointer deref in __qede_remove() ... [ Upstream commit deabc87111c690097c03765ea017cd500f7376fc ] While rebooting the system with SR-IOV vfs enabled leads to below crash due to recurrence of __qede_remove() on the VF devices (first from .shutdown() flow of the VF itself and another from PF's .shutdown() flow executing pci_disable_sriov()) This patch adds a safeguard in __qede_remove() flow to fix this, so that driver doesn't attempt to remove "already removed" devices. [ 194.360134] BUG: unable to handle kernel NULL pointer dereference at 00000000000008dc [ 194.360227] IP: [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede] [ 194.360304] PGD 0 [ 194.360325] Oops: 0000 [#1] SMP [ 194.360360] Modules linked in: tcp_lp fuse tun bridge stp llc devlink bonding ip_set nfnetlink ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib ib_umad rpcrdma sunrpc rdma_ucm ib_uverbs ib_iser rdma_cm iw_cm ib_cm libiscsi scsi_transport_iscsi dell_smbios iTCO_wdt iTCO_vendor_support dell_wmi_descriptor dcdbas vfat fat pcc_cpufreq skx_edac intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd qedr ib_core pcspkr ses enclosure joydev ipmi_ssif sg i2c_i801 lpc_ich mei_me mei wmi ipmi_si ipmi_devintf ipmi_msghandler tpm_crb acpi_pad acpi_power_meter xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_pclmul crct10dif_common crc32c_intel mgag200 [ 194.361044] qede i2c_algo_bit drm_kms_helper qed syscopyarea sysfillrect nvme sysimgblt fb_sys_fops ttm nvme_core mpt3sas crc8 ptp drm pps_core ahci raid_class scsi_transport_sas libahci libata drm_panel_orientation_quirks nfit libnvdimm dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ip_tables] [ 194.361297] CPU: 51 PID: 7996 Comm: reboot Kdump: loaded Not tainted 3.10.0-1062.el7.x86_64 #1 [ 194.361359] Hardware name: Dell Inc. PowerEdge MX840c/0740HW, BIOS 2.4.6 10/15/2019 [ 194.361412] task: ffff9cea9b360000 ti: ffff9ceabebdc000 task.ti: ffff9ceabebdc000 [ 194.361463] RIP: 0010:[<ffffffffc03553c4>] [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede] [ 194.361534] RSP: 0018:ffff9ceabebdfac0 EFLAGS: 00010282 [ 194.361570] RAX: 0000000000000000 RBX: ffff9cd013846098 RCX: 0000000000000000 [ 194.361621] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9cd013846098 [ 194.361668] RBP: ffff9ceabebdfae8 R08: 0000000000000000 R09: 0000000000000000 [ 194.361715] R10: 00000000bfe14201 R11: ffff9ceabfe141e0 R12: 0000000000000000 [ 194.361762] R13: ffff9cd013846098 R14: 0000000000000000 R15: ffff9ceab5e48000 [ 194.361810] FS: 00007f799c02d880(0000) GS:ffff9ceacb0c0000(0000) knlGS:0000000000000000 [ 194.361865] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 194.361903] CR2: 00000000000008dc CR3: 0000001bdac76000 CR4: 00000000007607e0 [ 194.361953] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 194.362002] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 194.362051] PKRU: 55555554 [ 194.362073] Call Trace: [ 194.362109] [<ffffffffc0355500>] qede_remove+0x10/0x20 [qede] [ 194.362180] [<ffffffffb97d0f3e>] pci_device_remove+0x3e/0xc0 [ 194.362240] [<ffffffffb98b3c52>] __device_release_driver+0x82/0xf0 [ 194.362285] [<ffffffffb98b3ce3>] device_release_driver+0x23/0x30 [ 194.362343] [<ffffffffb97c86d4>] pci_stop_bus_device+0x84/0xa0 [ 194.362388] [<ffffffffb97c87e2>] pci_stop_and_remove_bus_device+0x12/0x20 [ 194.362450] [<ffffffffb97f153f>] pci_iov_remove_virtfn+0xaf/0x160 [ 194.362496] [<ffffffffb97f1aec>] sriov_disable+0x3c/0xf0 [ 194.362534] [<ffffffffb97f1bc3>] pci_disable_sriov+0x23/0x30 [ 194.362599] [<ffffffffc02f83c3>] qed_sriov_disable+0x5e3/0x650 [qed] [ 194.362658] [<ffffffffb9622df6>] ? kfree+0x106/0x140 [ 194.362709] [<ffffffffc02cc0c0>] ? qed_free_stream_mem+0x70/0x90 [qed] [ 194.362754] [<ffffffffb9622df6>] ? kfree+0x106/0x140 [ 194.362803] [<ffffffffc02cd659>] qed_slowpath_stop+0x1a9/0x1d0 [qed] [ 194.362854] [<ffffffffc035544e>] __qede_remove+0xae/0x130 [qede] [ 194.362904] [<ffffffffc03554e0>] qede_shutdown+0x10/0x20 [qede] [ 194.362956] [<ffffffffb97cf90a>] pci_device_shutdown+0x3a/0x60 [ 194.363010] [<ffffffffb98b180b>] device_shutdown+0xfb/0x1f0 [ 194.363066] [<ffffffffb94b66c6>] kernel_restart_prepare+0x36/0x40 [ 194.363107] [<ffffffffb94b66e2>] kernel_restart+0x12/0x60 [ 194.363146] [<ffffffffb94b6959>] SYSC_reboot+0x229/0x260 [ 194.363196] [<ffffffffb95f200d>] ? handle_mm_fault+0x39d/0x9b0 [ 194.363253] [<ffffffffb942b621>] ? __switch_to+0x151/0x580 [ 194.363304] [<ffffffffb9b7ec28>] ? __schedule+0x448/0x9c0 [ 194.363343] [<ffffffffb94b69fe>] SyS_reboot+0xe/0x10 [ 194.363387] [<ffffffffb9b8bede>] system_call_fastpath+0x25/0x2a [ 194.363430] Code: f9 e9 37 ff ff ff 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 4c 8d af 98 00 00 00 41 54 4c 89 ef 41 89 f4 53 e8 4c e4 55 f9 <80> b8 dc 08 00 00 01 48 89 c3 4c 8d b8 c0 08 00 00 4c 8b b0 c0 [ 194.363712] RIP [<ffffffffc03553c4>] __qede_remove+0x24/0x130 [qede] [ 194.363764] RSP <ffff9ceabebdfac0> [ 194.363791] CR2: 00000000000008dc Signed-off-by: Manish Chopra <manishc@marvell.com> Signed-off-by: Ariel Elior <aelior@marvell.com> Signed-off-by: Sudarsana Kalluru <skalluru@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-12 19:13:16 +01:00
..
appletalk	net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT	2018-09-29 03:08:52 -07:00
arcnet	arcnet: provide a buffer big enough to actually receive packets	2019-10-05 12:27:41 +02:00
bonding	bonding: fix potential NULL deref in bond_update_slave_arr	2019-11-06 12:09:23 +01:00
caif	caif-hsi: fix possible deadlock in cfhsi_exit_module()	2019-08-04 09:34:54 +02:00
can	can: mcp251x: mcp251x_hw_reset(): allow more time after a reset	2019-10-17 13:40:53 -07:00
cris
dsa	net: dsa: mv88e6xxx: Fix u64 statistics	2019-03-23 08:44:23 +01:00
ethernet	qede: fix NULL pointer deref in __qede_remove()	2019-11-12 19:13:16 +01:00
fddi
fjes	fjes: Fix wrong netdevice feature flags	2017-12-20 10:04:55 +01:00
hamradio	net: hamradio: use eth_broadcast_addr	2018-08-24 13:26:55 +02:00
hippi	hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close	2018-02-25 11:03:42 +01:00
hyperv	hv_netvsc: use skb_get_hash() instead of a homegrown implementation	2017-03-26 12:13:18 +02:00
ieee802154	ieee802154: atusb: fix use-after-free at disconnect	2019-10-17 13:40:54 -07:00
ipvlan	ipvlan: disallow userns cap_net_admin to change global mode/flags	2019-03-23 08:44:31 +01:00
irda	irda: fix overly long udelay()	2018-06-06 16:46:21 +02:00
phy	net/phy: fix DP83865 10 Mbps HDX loopback disable function	2019-10-05 12:27:41 +02:00
plip
ppp	compat_ioctl: pppoe: fix PPPOEIOCSFWD handling	2019-08-11 12:20:46 +02:00
slip	slip: make slhc_free() silently accept an error pointer	2019-05-16 19:44:51 +02:00
team	team: Always enable vlan tx offload	2019-07-10 09:56:37 +02:00
usb	CDC-NCM: handle incomplete transfer of MTU	2019-11-12 19:13:14 +01:00
vmxnet3	vmxnet3: ensure that adapter is in proper state during force_close	2018-04-13 19:50:04 +02:00
wan	drivers: net: lmc: fix case value for target abort error	2018-09-05 09:18:36 +02:00
wimax	wimax/i2400m: fix a memory leak bug	2019-09-10 10:29:47 +01:00
wireless	rtlwifi: Fix potential overflow on P2P code	2019-11-06 12:09:22 +01:00
xen-netback	xen/netback: fix error path of xenvif_connect_data()	2019-10-29 09:13:32 +01:00
dummy.c
eql.c
geneve.c
ifb.c
Kconfig	vmxnet3: prevent building with 64K pages	2018-02-25 11:03:42 +01:00
LICENSE.SRC
loopback.c	net: introduce device min_header_len	2017-02-18 16:39:27 +01:00
macvlan.c	macvlan: Only deliver one copy of the frame to the macvlan interface	2017-12-20 10:05:01 +01:00
macvtap.c	tun/tap: sanitize TUNSETSNDBUF input	2017-11-18 11:11:05 +01:00
Makefile
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c	rapidio/rionet: do not free skb before reading its length	2018-12-13 09:21:26 +01:00
sb1000.c
Space.c
sungem_phy.c
tun.c	tun: fix use-after-free when register netdev failed	2019-09-21 07:12:41 +02:00
veth.c	veth: set peer GSO values	2018-03-22 09:23:29 +01:00
virtio_net.c	virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS	2018-05-30 07:49:11 +02:00
vrf.c	vrf: Fix use after free and double free in vrf_finish_output	2018-04-13 19:50:27 +02:00
vxlan.c	vxlan: check tun_info options_len properly	2019-11-10 11:21:12 +01:00
xen-netfront.c	xen-netfront: do not use ~0U as error return value for xennet_fill_frags()	2019-10-07 21:01:06 +02:00