niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity
linux/drivers/net/ethernet/broadcom
History
Selvin Xavier 89b59a84cb bnxt_en: Fix the double free during device removal 
Following warning reported by KASAN during driver unload

==================================================================
BUG: KASAN: double-free in bnxt_remove_one+0x103/0x200 [bnxt_en]
Free of addr ffff88814e8dd4c0 by task rmmod/17469
CPU: 47 PID: 17469 Comm: rmmod Kdump: loaded Tainted: G S                 6.2.0-rc7+ #2
Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.3.10 08/15/2019
Call Trace:
 <TASK>
 dump_stack_lvl+0x33/0x46
 print_report+0x17b/0x4b3
 ? __call_rcu_common.constprop.79+0x27e/0x8c0
 ? __pfx_free_object_rcu+0x10/0x10
 ? __virt_addr_valid+0xe3/0x160
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 kasan_report_invalid_free+0x64/0xd0
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 __kasan_slab_free+0x179/0x1c0
 ? bnxt_remove_one+0x103/0x200 [bnxt_en]
 __kmem_cache_free+0x194/0x350
 bnxt_remove_one+0x103/0x200 [bnxt_en]
 pci_device_remove+0x62/0x110
 device_release_driver_internal+0xf6/0x1c0
 driver_detach+0x76/0xe0
 bus_remove_driver+0x89/0x160
 pci_unregister_driver+0x26/0x110
 ? strncpy_from_user+0x188/0x1c0
 bnxt_exit+0xc/0x24 [bnxt_en]
 __x64_sys_delete_module+0x21f/0x390
 ? __pfx___x64_sys_delete_module+0x10/0x10
 ? __pfx_mem_cgroup_handle_over_high+0x10/0x10
 ? _raw_spin_lock+0x87/0xe0
 ? __pfx__raw_spin_lock+0x10/0x10
 ? __audit_syscall_entry+0x185/0x210
 ? ktime_get_coarse_real_ts64+0x51/0x80
 ? syscall_trace_enter.isra.18+0x126/0x1a0
 do_syscall_64+0x37/0x90
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7effcb6fd71b
Code: 73 01 c3 48 8b 0d 6d 17 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 17 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffeada270b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
RAX: ffffffffffffffda RBX: 00005623660e0750 RCX: 00007effcb6fd71b
RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005623660e07b8
RBP: 0000000000000000 R08: 00007ffeada26031 R09: 0000000000000000
R10: 00007effcb771280 R11: 0000000000000206 R12: 00007ffeada272e0
R13: 00007ffeada28bc4 R14: 00005623660e02a0 R15: 00005623660e0750
 </TASK>

Auxiliary device structures are freed in bnxt_aux_dev_release. So avoid
calling kfree from bnxt_remove_one.

Also, set bp->edev to NULL before freeing the auxilary private structure.

Fixes: d80d88b0df ("bnxt_en: Add auxiliary driver support")
Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Reviewed-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-03-06 09:36:08 +00:00
..
bnx2x Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-11-29 13:04:52 -08:00
bnxt bnxt_en: Fix the double free during device removal 2023-03-06 09:36:08 +00:00
genet Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2023-02-21 09:29:25 -08:00
b44.c net: b44: Remove the unused function __b44_cam_read() 2023-01-30 21:03:51 -08:00
b44.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bcm63xx_enet.c net: ethernet: broadcom: bcm63xx_enet: Drop empty platform remove function 2022-12-30 07:28:49 +00:00
bcm63xx_enet.h bcm63xx_enet: convert to build_skb 2021-01-07 12:39:53 -08:00
bcm4908_enet.c net: broadcom: bcm4908_enet: report queued and transmitted bytes 2022-11-02 20:38:04 -07:00
bcm4908_enet.h net: broadcom: rename BCM4908 driver & update DT binding 2021-02-11 15:04:17 -08:00
bcmsysport.c net: systemport: Add support for RDMA overflow statistic counter 2022-10-31 20:05:03 -07:00
bcmsysport.h net: systemport: Add support for RDMA overflow statistic counter 2022-10-31 20:05:03 -07:00
bgmac-bcma-mdio.c net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register 2022-06-06 14:38:15 -07:00
bgmac-bcma.c net: bgmac: fix BCM5358 support by setting correct flags 2023-02-09 22:25:31 -08:00
bgmac-platform.c Revert "net: ethernet: bgmac: Use devm_platform_ioremap_resource_byname" 2022-02-17 08:45:34 -08:00
bgmac.c bgmac: fix *initial* chip reset to support BCM5358 2023-02-28 11:10:05 +01:00
bgmac.h bgmac: fix *initial* chip reset to support BCM5358 2023-02-28 11:10:05 +01:00
bnx2.c skbuff: Introduce slab_build_skb() 2022-12-09 19:47:41 -08:00
bnx2.h
bnx2_fw.h
cnic.c dma-mapping updates for Linux 2.6 2022-12-13 09:05:19 -08:00
cnic.h
cnic_defs.h net: cnic: fix spelling mistake "reserverd" -> "reserved" 2020-02-17 21:59:16 -08:00
cnic_if.h
Kconfig bnxt_en: Add auxiliary driver support 2023-02-01 19:02:06 -08:00
Makefile net: ethernet: bgmac: Remove -Warray-bounds exception 2022-10-07 08:50:07 +01:00
sb1250-mac.c eth: switch to netif_napi_add_weight() 2022-05-08 11:33:57 +01:00
tg3.c net/tg3: resolve deadlock in tg3_reset_task() during EEH 2023-01-25 22:35:42 -08:00
tg3.h tg3: Read VPD with pci_vpd_alloc() 2021-08-20 15:49:00 -05:00
unimac.h net: broadcom: share header defining UniMAC registers 2021-01-08 19:17:28 -08:00