| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <B3B02A22-805C-4800-AB4D-81F1E3FA298E@qlogic.com>
Date: Thu, 30 Jun 2016 17:20:06 +0000
From: Quinn Tran <quinn.tran@...gic.com>
To: Bruno Prémont <bonbons@...ux-vserver.org>,
"Himanshu Madhani" <himanshu.madhani@...gic.com>,
Nicholas Bellinger <nab@...ux-iscsi.org>
CC: Dept-Eng QLA2xxx Upstream <qla2xxx-upstream@...gic.com>,
"James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
"Martin K. Petersen" <martin.petersen@...cle.com>,
linux-scsi <linux-scsi@...r.kernel.org>,
linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] qla2xxx: Fix NULL pointer deref in QLA interrupt
Ack. Looks good. Thanks.
Regards,
Quinn Tran
-----Original Message-----
From: Bruno Prémont <bonbons@...ux-vserver.org>
Date: Thursday, June 30, 2016 at 8:00 AM
To: Quinn Tran <quinn.tran@...gic.com>, Himanshu Madhani <himanshu.madhani@...gic.com>, Nicholas Bellinger <nab@...ux-iscsi.org>
Cc: Dept-Eng QLA2xxx Upstream <qla2xxx-upstream@...gic.com>, "James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>, "Martin K. Petersen" <martin.petersen@...cle.com>, linux-scsi <linux-scsi@...r.kernel.org>, linux-kernel <linux-kernel@...r.kernel.org>
Subject: [PATCH] qla2xxx: Fix NULL pointer deref in QLA interrupt
>In qla24xx_process_response_queue() rsp->msix->cpuid may trigger NULL
>pointer dereference when rsp->msix is NULL:
>
>[ 5.622457] NULL pointer dereference at 0000000000000050
>[ 5.622457] IP: [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
>[ 5.622457] PGD 0
>[ 5.622457] Oops: 0000 [#1] SMP
>[ 5.622457] Modules linked in:
>[ 5.622457] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.6.3-x86_64 #1
>[ 5.622457] Hardware name: HP ProLiant DL360 G5, BIOS P58 05/02/2011
>[ 5.622457] task: ffff8801a88f3740 ti: ffff8801a8954000 task.ti: ffff8801a8954000
>[ 5.622457] RIP: 0010:[<ffffffff8155e614>] [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
>[ 5.622457] RSP: 0000:ffff8801afb03de8 EFLAGS: 00010002
>[ 5.622457] RAX: 0000000000000000 RBX: 0000000000000032 RCX: 00000000ffffffff
>[ 5.622457] RDX: 0000000000000002 RSI: ffff8801a79bf8c8 RDI: ffff8800c8f7e7c0
>[ 5.622457] RBP: ffff8801afb03e68 R08: 0000000000000000 R09: 0000000000000000
>[ 5.622457] R10: 00000000ffff8c47 R11: 0000000000000002 R12: ffff8801a79bf8c8
>[ 5.622457] R13: ffff8800c8f7e7c0 R14: ffff8800c8f60000 R15: 0000000000018013
>[ 5.622457] FS: 0000000000000000(0000) GS:ffff8801afb00000(0000) knlGS:0000000000000000
>[ 5.622457] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>[ 5.622457] CR2: 0000000000000050 CR3: 0000000001e07000 CR4: 00000000000006e0
>[ 5.622457] Stack:
>[ 5.622457] ffff8801afb03e30 ffffffff810c0f2d 0000000000000086 0000000000000002
>[ 5.622457] ffff8801afb03e28 ffffffff816570e1 ffff8800c8994628 0000000000000002
>[ 5.622457] ffff8801afb03e60 ffffffff816772d4 b47c472ad6955e68 0000000000000032
>[ 5.622457] Call Trace:
>[ 5.622457] <IRQ>
>[ 5.622457] [<ffffffff810c0f2d>] ? __wake_up_common+0x4d/0x80
>[ 5.622457] [<ffffffff816570e1>] ? usb_hcd_resume_root_hub+0x51/0x60
>[ 5.622457] [<ffffffff816772d4>] ? uhci_hub_status_data+0x64/0x240
>[ 5.622457] [<ffffffff81560d00>] qla24xx_intr_handler+0xf0/0x2e0
>[ 5.622457] [<ffffffff810d569e>] ? get_next_timer_interrupt+0xce/0x200
>[ 5.622457] [<ffffffff810c89b4>] handle_irq_event_percpu+0x64/0x100
>[ 5.622457] [<ffffffff810c8a77>] handle_irq_event+0x27/0x50
>[ 5.622457] [<ffffffff810cb965>] handle_edge_irq+0x65/0x140
>[ 5.622457] [<ffffffff8101a498>] handle_irq+0x18/0x30
>[ 5.622457] [<ffffffff8101a276>] do_IRQ+0x46/0xd0
>[ 5.622457] [<ffffffff817f8fff>] common_interrupt+0x7f/0x7f
>[ 5.622457] <EOI>
>[ 5.622457] [<ffffffff81020d38>] ? mwait_idle+0x68/0x80
>[ 5.622457] [<ffffffff8102114a>] arch_cpu_idle+0xa/0x10
>[ 5.622457] [<ffffffff810c1b97>] default_idle_call+0x27/0x30
>[ 5.622457] [<ffffffff810c1d3b>] cpu_startup_entry+0x19b/0x230
>[ 5.622457] [<ffffffff810324c6>] start_secondary+0x136/0x140
>[ 5.622457] Code: 00 00 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 48 8b 47 58 a8 02 0f 84 c5 00 00 00 48 8b 46 50 49 89 f4 65 8b 15 34 bb aa 7e <39> 50 50 74 11 89 50 50 48 8b 46 50 8b 40 50 41 89 86 60 8b 00
>[ 5.622457] RIP [<ffffffff8155e614>] qla24xx_process_response_queue+0x44/0x4b0
>[ 5.622457] RSP <ffff8801afb03de8>
>[ 5.622457] CR2: 0000000000000050
>[ 5.622457] ---[ end trace fa2b19c25106d42b ]---
>[ 5.622457] Kernel panic - not syncing: Fatal exception in interrupt
>
>
>The affected code was introduced by commit cdb898c52d1dfad4b4800b83a58b3fe5d352edde
>(qla2xxx: Add irq affinity notification).
>
>Only dereference rsp->msix when it has been set so the machine can boot
>fine. Possibly rsp->msix is unset because:
>[ 3.479679] qla2xxx [0000:00:00.0]-0005: : QLogic Fibre Channel HBA Driver: 8.07.00.33-k.
>[ 3.481839] qla2xxx [0000:13:00.0]-001d: : Found an ISP2432 irq 17 iobase 0xffffc90000038000.
>[ 3.484081] qla2xxx [0000:13:00.0]-0035:0: MSI-X; Unsupported ISP2432 (0x2, 0x3).
>[ 3.485804] qla2xxx [0000:13:00.0]-0037:0: Falling back-to MSI mode -258.
>[ 3.890145] scsi host0: qla2xxx
>[ 3.891956] qla2xxx [0000:13:00.0]-00fb:0: QLogic QLE2460 - PCI-Express Single Channel 4Gb Fibre Channel HBA.
>[ 3.894207] qla2xxx [0000:13:00.0]-00fc:0: ISP2432: PCIe (2.5GT/s x4) @ 0000:13:00.0 hdma+ host#=0 fw=7.03.00 (9496).
>[ 5.714774] qla2xxx [0000:13:00.0]-500a:0: LOOP UP detected (4 Gbps).
>
>
>CC: <stable@...r.kernel.org>
>Signed-off-by: Bruno Prémont <bonbons@...ux-vserver.org>
>---
>diff --git a/drivers/scsi/qla2xxx/qla_isr.c
>b/drivers/scsi/qla2xxx/qla_isr.c index 5649c20..a92a62d 100644
>--- a/drivers/scsi/qla2xxx/qla_isr.c
>+++ b/drivers/scsi/qla2xxx/qla_isr.c
>@@ -2548,7 +2548,7 @@ void qla24xx_process_response_queue(struct
>scsi_qla_host *vha, if (!vha->flags.online)
> return;
>
>- if (rsp->msix->cpuid != smp_processor_id()) {
>+ if (rsp->msix && rsp->msix->cpuid != smp_processor_id()) {
> /* if kernel does not notify qla of IRQ's CPU change,
> * then set it here.
> */
Powered by blists - more mailing lists