Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3516646pxf; Mon, 15 Mar 2021 11:17:01 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwAqr6m9MTN9au7ky9Qs09R3VwdXQriIKjF0bLs/3EQ2IURFJj72rRZ9lO6IBOj0+AdDYCn X-Received: by 2002:a17:906:1d55:: with SMTP id o21mr25180315ejh.485.1615832221059; Mon, 15 Mar 2021 11:17:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615832221; cv=none; d=google.com; s=arc-20160816; b=natTOJPeXUMzvde3an1hTstCc8iGgL0sbe5mWrI2Ln3y9qHoNOi1ErxMk/rjYMCXl6 dL1h0GuLBSjey3D5oszE4L+AcGl210yYmQRS1OEGEmy6Dob//GKy2wbYp9Q4i/i3cVob KOvArw9RoBigf8xh4uJvROVQrRPIyt8n7VFRFrmfTbUdTjjl8UdWR7b3Nn+jtz6K/2mV g5E2krbMNgbgrZrfrGoD7EkY2UFPXIUJuhhQCbncYz3O8yQtsGIoZmWbXePK30HQr7nw Du83WkhMRJ3er+7zP5urebZKWyU4qFlUAoZ9PF6ZC1nd0qM86Nq4uySC+HHXXjJ3Azx8 KZag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Fr3/Nzp7ZAtxshWXjc0HeV9BXkWZJ3kCjKoBkcNo3Hw=; b=tA7dfEMcw6/wV6k3e/LpXi2m4y4PYcWAGmHcRBSFu5Bm5ctk9RbfpBVa8idPp8Yi6J xgstYSpadiqrUHB4/IIJkMUaTt3nZ/UPFVaQZlJyqHPh33oi+qkwWJnVeo2N9UD2fvIA JfX81Ej0ZIvaxtwFTYSwtqN3zqKeJ1PkHX0LXl+3QIlzMdNjx94gfR6kEN4j3GazsMBh ZnMMuK4bCUW0uM1O2RObMeXmWbU5lQMN1NgMp1WRZK/pCvqHQ0sVgqBBdah1nNJDvDG2 YlBLknyCWKypSgDr6I/9jv2yL/QeKQLz5f80jnNqvqODy3kOMPxn47yuyyKGdcCCtf+V UNEQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=io3nJsMb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id zj12si11230954ejb.508.2021.03.15.11.16.37; Mon, 15 Mar 2021 11:17:01 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=io3nJsMb; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232539AbhCOOQL (ORCPT + 99 others); Mon, 15 Mar 2021 10:16:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:38284 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232040AbhCON7M (ORCPT ); Mon, 15 Mar 2021 09:59:12 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id B39C364D9E; Mon, 15 Mar 2021 13:58:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816727; bh=feoRGB0m9/7cM9bYnm40eLvBOV4SCiIQkTpYaUfRd20=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=io3nJsMbCy2oZSjJwStUtEdsgh4LNxZmODi/U6IMpuELeIfq5CPKo+Z2JFg0UuGDv nRoPPV5f9GUHyYTOCc+ihQ88pusjhLtLwz5+loZhBnJuQw7TJ567xBfN/HsUUsF8Ej gs6g5d3dzVDh0Izagfncv0T+2JBm5mLZkQvEQkW0= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Scott Branden , Edwin Peer , Michael Chan , Jakub Kicinski Subject: [PATCH 5.10 078/290] bnxt_en: reliably allocate IRQ table on reset to avoid crash Date: Mon, 15 Mar 2021 14:52:51 +0100 Message-Id: <20210315135544.551794867@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135541.921894249@linuxfoundation.org> References: <20210315135541.921894249@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Edwin Peer commit 20d7d1c5c9b11e9f538ed4a2289be106de970d3e upstream. The following trace excerpt corresponds with a NULL pointer dereference of 'bp->irq_tbl' in bnxt_setup_inta() on an Aarch64 system after many device resets: Unable to handle kernel NULL pointer dereference at ... 000000d ... pc : string+0x3c/0x80 lr : vsnprintf+0x294/0x7e0 sp : ffff00000f61ba70 pstate : 20000145 x29: ffff00000f61ba70 x28: 000000000000000d x27: ffff0000009c8b5a x26: ffff00000f61bb80 x25: ffff0000009c8b5a x24: 0000000000000012 x23: 00000000ffffffe0 x22: ffff000008990428 x21: ffff00000f61bb80 x20: 000000000000000d x19: 000000000000001f x18: 0000000000000000 x17: 0000000000000000 x16: ffff800b6d0fb400 x15: 0000000000000000 x14: ffff800b7fe31ae8 x13: 00001ed16472c920 x12: ffff000008c6b1c9 x11: ffff000008cf0580 x10: ffff00000f61bb80 x9 : 00000000ffffffd8 x8 : 000000000000000c x7 : ffff800b684b8000 x6 : 0000000000000000 x5 : 0000000000000065 x4 : 0000000000000001 x3 : ffff0a00ffffff04 x2 : 000000000000001f x1 : 0000000000000000 x0 : 000000000000000d Call trace: string+0x3c/0x80 vsnprintf+0x294/0x7e0 snprintf+0x44/0x50 __bnxt_open_nic+0x34c/0x928 [bnxt_en] bnxt_open+0xe8/0x238 [bnxt_en] __dev_open+0xbc/0x130 __dev_change_flags+0x12c/0x168 dev_change_flags+0x20/0x60 ... Ordinarily, a call to bnxt_setup_inta() (not in trace due to inlining) would not be expected on a system supporting MSIX at all. However, if bnxt_init_int_mode() does not end up being called after the call to bnxt_clear_int_mode() in bnxt_fw_reset_close(), then the driver will think that only INTA is supported and bp->irq_tbl will be NULL, causing the above crash. In the error recovery scenario, we call bnxt_clear_int_mode() in bnxt_fw_reset_close() early in the sequence. Ordinarily, we will call bnxt_init_int_mode() in bnxt_hwrm_if_change() after we reestablish communication with the firmware after reset. However, if the sequence has to abort before we call bnxt_init_int_mode() and if the user later attempts to re-open the device, then it will cause the crash above. We fix it in 2 ways: 1. Check for bp->irq_tbl in bnxt_setup_int_mode(). If it is NULL, call bnxt_init_init_mode(). 2. If we need to abort in bnxt_hwrm_if_change() and cannot complete the error recovery sequence, set the BNXT_STATE_ABORT_ERR flag. This will cause more drastic recovery at the next attempt to re-open the device, including a call to bnxt_init_int_mode(). Fixes: 3bc7d4a352ef ("bnxt_en: Add BNXT_STATE_IN_FW_RESET state.") Reviewed-by: Scott Branden Signed-off-by: Edwin Peer Signed-off-by: Michael Chan Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -8430,10 +8430,18 @@ static void bnxt_setup_inta(struct bnxt bp->irq_tbl[0].handler = bnxt_inta; } +static int bnxt_init_int_mode(struct bnxt *bp); + static int bnxt_setup_int_mode(struct bnxt *bp) { int rc; + if (!bp->irq_tbl) { + rc = bnxt_init_int_mode(bp); + if (rc || !bp->irq_tbl) + return rc ?: -ENODEV; + } + if (bp->flags & BNXT_FLAG_USING_MSIX) bnxt_setup_msix(bp); else @@ -8618,7 +8626,7 @@ static int bnxt_init_inta(struct bnxt *b static int bnxt_init_int_mode(struct bnxt *bp) { - int rc = 0; + int rc = -ENODEV; if (bp->flags & BNXT_FLAG_MSIX_CAP) rc = bnxt_init_msix(bp); @@ -9339,7 +9347,8 @@ static int bnxt_hwrm_if_change(struct bn { struct hwrm_func_drv_if_change_output *resp = bp->hwrm_cmd_resp_addr; struct hwrm_func_drv_if_change_input req = {0}; - bool resc_reinit = false, fw_reset = false; + bool fw_reset = !bp->irq_tbl; + bool resc_reinit = false; u32 flags = 0; int rc; @@ -9367,6 +9376,7 @@ static int bnxt_hwrm_if_change(struct bn if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state) && !fw_reset) { netdev_err(bp->dev, "RESET_DONE not set during FW reset.\n"); + set_bit(BNXT_STATE_ABORT_ERR, &bp->state); return -ENODEV; } if (resc_reinit || fw_reset) {