Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Mohammed Gamal <mgamal@redhat.com>
To:     sthemmin@microsoft.com, netdev@vger.kernel.org
Cc:     kys@microsoft.com, haiyangz@microsoft.com, vkuznets@redhat.com,
        otubo@redhat.com, cavery@redhat.com, linux-kernel@vger.kernel.org,
        devel@linuxdriverproject.org, Mohammed Gamal <mgamal@redhat.com>
Subject: [PATCH] hv_netvsc: Make sure out channel is fully opened on send
Date:   Wed, 26 Sep 2018 18:34:19 +0200
Message-Id: <1537979659-26979-1-git-send-email-mgamal@redhat.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Dring high network traffic changes to network interface parameters
such as number of channels or MTU can cause a kernel panic with a NULL
pointer dereference. This is due to netvsc_device_remove() being
called and deallocating the channel ring buffers, which can then be
accessed by netvsc_send_pkt() before they're allocated on calling
netvsc_device_add()

The patch fixes this problem by checking the channel state and returning
ENODEV if not yet opened. We also move the call to hv_ringbuf_avail_percent()
which may access the uninitialized ring buffer.

Signed-off-by: Mohammed Gamal <mgamal@redhat.com>
---
 drivers/net/hyperv/netvsc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index fe01e14..75f1b31 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -825,7 +825,12 @@ static inline int netvsc_send_pkt(
 	struct netdev_queue *txq = netdev_get_tx_queue(ndev, packet->q_idx);
 	u64 req_id;
 	int ret;
-	u32 ring_avail = hv_get_avail_to_write_percent(&out_channel->outbound);
+	u32 ring_avail;
+
+	if (out_channel->state != CHANNEL_OPENED_STATE)
+		return -ENODEV;
+
+	ring_avail = hv_get_avail_to_write_percent(&out_channel->outbound);
 
 	nvmsg.hdr.msg_type = NVSP_MSG1_TYPE_SEND_RNDIS_PKT;
 	if (skb)
-- 
1.8.3.1