[5.17,028/146] ice: fix crash in switchdev mode

From: Wojciech Drewek <wojciech.drewek@intel.com>

From: Wojciech Drewek <wojciech.drewek@intel.com>

[ Upstream commit d201665147ae788b7cca9fab58a1826f64152034 ]

Below steps end up with crash:
- modprobe ice
- devlink dev eswitch set $PF1_PCI mode switchdev
- echo 64 > /sys/class/net/$PF1/device/sriov_numvfs
- rmmod ice

Calling ice_eswitch_port_start_xmit while the process of removing
VFs is in progress ends up with NULL pointer dereference.
That's because PR netdev is not released but some resources
are already freed. Fix it by checking if ICE_VF_DIS bit is set.

Call trace:
[ 1379.595146] BUG: kernel NULL pointer dereference, address: 0000000000000040
[ 1379.595284] #PF: supervisor read access in kernel mode
[ 1379.595410] #PF: error_code(0x0000) - not-present page
[ 1379.595535] PGD 0 P4D 0
[ 1379.595657] Oops: 0000 [#1] PREEMPT SMP PTI
[ 1379.595783] CPU: 4 PID: 974 Comm: NetworkManager Kdump: loaded Tainted: G           OE     5.17.0-rc8_mrq_dev-queue+ #12
[ 1379.595926] Hardware name: Intel Corporation S1200SP/S1200SP, BIOS S1200SP.86B.03.01.0042.013020190050 01/30/2019
[ 1379.596063] RIP: 0010:ice_eswitch_port_start_xmit+0x46/0xd0 [ice]
[ 1379.596292] Code: c7 c8 09 00 00 e8 9a c9 fc ff 84 c0 0f 85 82 00 00 00 4c 89 e7 e8 ca 70 fe ff 48 8b 7d 58 48 89 c3 48 85 ff 75 5e 48 8b 53 20 <8b> 42 40 85 c0 74 78 8d 48 01 f0 0f b1 4a 40 75 f2 0f b6 95 84 00
[ 1379.596456] RSP: 0018:ffffaba0c0d7bad0 EFLAGS: 00010246
[ 1379.596584] RAX: ffff969c14c71680 RBX: ffff969c14c71680 RCX: 000100107a0f0000
[ 1379.596715] RDX: 0000000000000000 RSI: ffff969b9d631000 RDI: 0000000000000000
[ 1379.596846] RBP: ffff969c07b46500 R08: ffff969becfca8ac R09: 0000000000000001
[ 1379.596977] R10: 0000000000000004 R11: ffffaba0c0d7bbec R12: ffff969b9d631000
[ 1379.597106] R13: ffffffffc08357a0 R14: ffff969c07b46500 R15: ffff969b9d631000
[ 1379.597237] FS:  00007f72c0e25c80(0000) GS:ffff969f13500000(0000) knlGS:0000000000000000
[ 1379.597414] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1379.597562] CR2: 0000000000000040 CR3: 000000012b316006 CR4: 00000000003706e0
[ 1379.597713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1379.597863] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1379.598015] Call Trace:
[ 1379.598153]  <TASK>
[ 1379.598294]  dev_hard_start_xmit+0xd9/0x220
[ 1379.598444]  sch_direct_xmit+0x8a/0x340
[ 1379.598592]  __dev_queue_xmit+0xa3c/0xd30
[ 1379.598739]  ? packet_parse_headers+0xb4/0xf0
[ 1379.598890]  packet_sendmsg+0xa15/0x1620
[ 1379.599038]  ? __check_object_size+0x46/0x140
[ 1379.599186]  sock_sendmsg+0x5e/0x60
[ 1379.599330]  ____sys_sendmsg+0x22c/0x270
[ 1379.599474]  ? import_iovec+0x17/0x20
[ 1379.599622]  ? sendmsg_copy_msghdr+0x59/0x90
[ 1379.599771]  ___sys_sendmsg+0x81/0xc0
[ 1379.599917]  ? __pollwait+0xd0/0xd0
[ 1379.600061]  ? preempt_count_add+0x68/0xa0
[ 1379.600210]  ? _raw_write_lock_irq+0x1a/0x40
[ 1379.600369]  ? ep_done_scan+0xc9/0x110
[ 1379.600494]  ? _raw_spin_unlock_irqrestore+0x25/0x40
[ 1379.600622]  ? preempt_count_add+0x68/0xa0
[ 1379.600747]  ? _raw_spin_lock_irq+0x1a/0x40
[ 1379.600899]  ? __fget_light+0x8f/0x110
[ 1379.601024]  __sys_sendmsg+0x49/0x80
[ 1379.601148]  ? release_ds_buffers+0x50/0xe0
[ 1379.601274]  do_syscall_64+0x3b/0x90
[ 1379.601399]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1379.601525] RIP: 0033:0x7f72c1e2e35d

Fixes: f5396b8a663f ("ice: switchdev slow path")
Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com>
Reported-by: Marcin Szycik <marcin.szycik@linux.intel.com>
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_eswitch.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20220426081750.858905110@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Wojciech Drewek <wojciech.drewek@intel.com>, Marcin Szycik <marcin.szycik@linux.intel.com>, Michal Swiatkowski <michal.swiatkowski@linux.intel.com>, Sandeep Penigalapati <sandeep.penigalapati@intel.com>, Tony Nguyen <anthony.l.nguyen@intel.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.17 028/146] ice: fix crash in switchdev mode Date: Tue, 26 Apr 2022 10:20:23 +0200 Message-Id: <20220426081750.858905110@linuxfoundation.org> In-Reply-To: <20220426081750.051179617@linuxfoundation.org> References: <20220426081750.051179617@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,002/146] perf tools: Fix segfault accessing sample_id xyarray [5.17,003/146] drm/amd/display: Only set PSR version when valid [5.17,004/146] block/compat_ioctl: fix range check in BLKGETSIZE [5.17,005/146] gfs2: assign rgrp glock before compute_bitstructs [5.17,006/146] scsi: ufs: core: scsi_get_lba() error fix [5.17,007/146] net/sched: cls_u32: fix netns refcount changes in u32_change() [5.17,008/146] ALSA: usb-audio: Clear MIDI port active flag after draining [5.17,009/146] ALSA: usb-audio: add mapping for MSI MAG X570S Torpedo MAX. [5.17,010/146] ALSA: hda/realtek: Add quirk for Clevo NP70PNP [5.17,011/146] ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek [5.17,012/146] ASoC: topology: Correct error handling in soc_tplg_dapm_widget_create() [5.17,013/146] ASoC: rk817: Use devm_clk_get() in rk817_platform_probe [5.17,014/146] ASoC: msm8916-wcd-digital: Check failure for devm_snd_soc_register_component [5.17,015/146] ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use [5.17,016/146] dmaengine: idxd: fix device cleanup on disable [5.17,017/146] dmaengine: imx-sdma: Fix error checking in sdma_event_remap [5.17,018/146] dmaengine: mediatek:Fix PM usage reference leak of mtk_uart_apdma_alloc_chan_resou... [5.17,019/146] dmaengine: dw-edma: Fix unaligned 64bit access [5.17,020/146] spi: spi-mtk-nor: initialize spi controller after resume [5.17,021/146] firmware: cs_dsp: Fix overrun of unterminated control name string [5.17,022/146] esp: limit skb_page_frag_refill use to a single page [5.17,023/146] spi: cadence-quadspi: fix incorrect supports_op() return value [5.17,024/146] igc: Fix infinite loop in release_swfw_sync [5.17,025/146] igc: Fix BUG: scheduling while atomic [5.17,026/146] igc: Fix suspending when PTM is active [5.17,027/146] ice: allow creating VFs for !CONFIG_NET_SWITCHDEV [5.17,028/146] ice: fix crash in switchdev mode [5.17,029/146] ice: Fix memory leak in ice_get_orom_civd_data() [5.17,030/146] ALSA: hda/hdmi: fix warning about PCM count when used with SOF [5.17,031/146] rxrpc: Restore removed timer deletion [5.17,032/146] net/smc: Fix sock leak when release after smc_shutdown() [5.17,033/146] net/packet: fix packet_sock xmit return value checking [5.17,034/146] ip6_gre: Avoid updating tunnel->tun_hlen in __gre6_xmit() [5.17,035/146] ip6_gre: Fix skb_under_panic in __gre6_xmit() [5.17,036/146] net: restore alpha order to Ethernet devices in config [5.17,037/146] net/sched: cls_u32: fix possible leak in u32_init_knode() [5.17,038/146] l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upp... [5.17,039/146] ipv6: make ip6_rt_gc_expire an atomic_t [5.17,040/146] can: isotp: stop timeout monitoring when no first frame was sent [5.17,041/146] net: dsa: hellcreek: Calculate checksums in tagger [5.17,042/146] net: mscc: ocelot: fix broken IP multicast flooding [5.17,043/146] netlink: reset network and mac headers in netlink_dump() [5.17,044/146] drm/i915/display/psr: Unset enable_psr2_sel_fetch if other checks in intel_psr2_co... [5.17,045/146] RISC-V: KVM: Remove s & u as valid ISA extension [5.17,046/146] RISC-V: KVM: Restrict the extensions that can be disabled [5.17,047/146] net: stmmac: Use readl_poll_timeout_atomic() in atomic state [5.17,048/146] dmaengine: idxd: match type for retries var in idxd_enqcmds() [5.17,049/146] dmaengine: idxd: fix retry value to be constant for duration of function call [5.17,050/146] dmaengine: idxd: add RO check for wq max_batch_size write [5.17,051/146] dmaengine: idxd: add RO check for wq max_transfer_size write [5.17,052/146] dmaengine: idxd: skip clearing device context when device is read-only [5.17,053/146] selftests: mlxsw: vxlan_flooding: Prevent flooding of unwanted packets [5.17,054/146] selftests: mlxsw: vxlan_flooding_ipv6: Prevent flooding of unwanted packets [5.17,055/146] userfaultfd: mark uffd_wp regardless of VM_WRITE flag [5.17,056/146] arm64: mm: fix p?d_leaf() [5.17,057/146] XArray: Disallow sibling entries of nodes [5.17,058/146] drm/msm/gpu: Rename runtime suspend/resume functions [5.17,059/146] drm/msm/gpu: Remove mutex from wait_event condition [5.17,060/146] ARM: vexpress/spc: Avoid negative array index when !SMP [5.17,061/146] reset: renesas: Check return value of reset_control_deassert() [5.17,062/146] reset: tegra-bpmp: Restore Handle errors in BPMP response [5.17,063/146] platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative [5.17,064/146] ALSA: usb-audio: Fix undefined behavior due to shift overflowing the constant [5.17,065/146] drm/msm/disp: check the return value of kzalloc() [5.17,066/146] selftests: KVM: Free the GIC FD when cleaning up in arch_timer [5.17,067/146] ALSA: hda: intel-dsp-config: update AlderLake PCI IDs [5.17,068/146] arm64: dts: imx: Fix imx8*-var-som touchscreen property sizes [5.17,069/146] vxlan: fix error return code in vxlan_fdb_append [5.17,070/146] cifs: Check the IOCB_DIRECT flag, not O_DIRECT [5.17,071/146] net: atlantic: Avoid out-of-bounds indexing [5.17,072/146] mt76: Fix undefined behavior due to shift overflowing the constant [5.17,073/146] brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant [5.17,074/146] dpaa_eth: Fix missing of_node_put in dpaa_get_ts_info() [5.17,075/146] drm/msm/mdp5: check the return of kzalloc() [5.17,076/146] KVM: x86: hyper-v: Avoid writing to TSC page without an active vCPU [5.17,077/146] net: macb: Restart tx only if queue pointer is lagging [5.17,078/146] scsi: iscsi: Release endpoint ID when its freed [5.17,079/146] scsi: iscsi: Merge suspend fields [5.17,080/146] scsi: iscsi: Fix NOP handling during conn recovery [5.17,081/146] scsi: qedi: Fix failed disconnect handling [5.17,082/146] stat: fix inconsistency between struct stat and struct compat_stat [5.17,083/146] VFS: filename_create(): fix incorrect intent. [5.17,084/146] nvme: add a quirk to disable namespace identifiers [5.17,085/146] nvme-pci: disable namespace identifiers for the MAXIO MAP1002/1202 [5.17,086/146] nvme-pci: disable namespace identifiers for Qemu controllers [5.17,087/146] irq_work: use kasan_record_aux_stack_noalloc() record callstack [5.17,088/146] EDAC/synopsys: Read the error count from the correct register [5.17,089/146] mm/memory-failure.c: skip huge_zero_page in memory_failure() [5.17,090/146] memcg: sync flush only if periodic flush is delayed [5.17,091/146] mm, hugetlb: allow for "high" userspace addresses [5.17,092/146] oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup [5.17,093/146] mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove() [5.17,094/146] ata: pata_marvell: Check the bmdma_addr beforing reading [5.17,095/146] dma: at_xdmac: fix a missing check on list iterator [5.17,096/146] dmaengine: imx-sdma: fix init of uart scripts [5.17,097/146] net: atlantic: invert deep par in pm functions, preventing null derefs [5.17,098/146] drm/radeon: fix logic inversion in radeon_sync_resv [5.17,099/146] io_uring: free iovec if file assignment fails [5.17,100/146] Input: omap4-keypad - fix pm_runtime_get_sync() error checking [5.17,101/146] scsi: sr: Do not leak information in ioctl [5.17,102/146] sched/pelt: Fix attach_entity_load_avg() corner case [5.17,103/146] perf/core: Fix perf_mmap fail when CONFIG_PERF_USE_VMALLOC enabled [5.17,104/146] drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised [5.17,105/146] drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare [5.17,106/146] powerpc/time: Always set decrementer in timer_interrupt() [5.17,107/146] KVM: PPC: Fix TCE handling for VFIO [5.17,108/146] drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync() usage [5.17,109/146] powerpc/perf: Fix power9 event alternatives [5.17,110/146] powerpc/perf: Fix power10 event alternatives [5.17,111/146] arm/xen: Fix some refcount leaks [5.17,112/146] perf script: Always allow field data_src for auxtrace [5.17,113/146] perf report: Set PERF_SAMPLE_DATA_SRC bit for Arm SPE event [5.17,114/146] fs: fix acl translation [5.17,115/146] cifs: fix NULL ptr dereference in refresh_mounts() [5.17,116/146] cifs: use correct lock type in cifs_reconnect() [5.17,117/146] xtensa: patch_text: Fixup last cpu should be master [5.17,118/146] xtensa: fix a7 clobbering in coprocessor context load/store [5.17,119/146] openvswitch: fix OOB access in reserve_sfa_size() [5.17,120/146] gpio: Request interrupts after IRQ is initialized [5.17,121/146] ASoC: rt5682: fix an incorrect NULL check on list iterator [5.17,122/146] ASoC: soc-dapm: fix two incorrect uses of list iterator [5.17,123/146] e1000e: Fix possible overflow in LTR decoding [5.17,124/146] codecs: rt5682s: fix an incorrect NULL check on list iterator [5.17,125/146] ARC: entry: fix syscall_trace_exit argument [5.17,126/146] drm/vmwgfx: Fix gem refcounting and memory evictions [5.17,127/146] arm_pmu: Validate single/group leader events [5.17,128/146] KVM: x86/pmu: Update AMD PMC sample period to fix guest NMI-watchdog [5.17,129/146] KVM: x86: Dont re-acquire SRCU lock in complete_emulated_io() [5.17,130/146] KVM: x86: Pend KVM_REQ_APICV_UPDATE during vCPU creation to fix a race [5.17,131/146] KVM: nVMX: Defer APICv updates while L2 is active until L1 is active [5.17,132/146] KVM: SVM: Simplify and harden helper to flush SEV guest page(s) [5.17,133/146] KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs [5.17,134/146] ext4: fix fallocate to use file_modified to update permissions consistently [5.17,135/146] ext4: fix symlink file size not match to file content [5.17,136/146] ext4: fix use-after-free in ext4_search_dir [5.17,137/146] ext4: limit length to bitmap_maxbytes - blocksize in punch_hole [5.17,138/146] ext4, doc: fix incorrect h_reserved size [5.17,139/146] ext4: fix overhead calculation to account for the reserved gdt blocks [5.17,140/146] ext4: force overhead calculation if the s_overhead_cluster makes no sense [5.17,141/146] ext4: update the cached overhead value in the superblock [5.17,142/146] jbd2: fix a potential race while discarding reserved buffers after an abort [5.17,143/146] spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and controller [5.17,144/146] ASoC: SOF: topology: cleanup dailinks on widget unload [5.17,145/146] io_uring: fix leaks on IOPOLL and CQE_SKIP [5.17,146/146] arm64: dts: qcom: add IPA qcom,qmp property

[5.17,028/146] ice: fix crash in switchdev mode

Commit Message

Patch