netdev - [PATCH net 13/16] ionic: disable napi when ionic_lif

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 24 Jan 2022 10:53:09 -0800
From:   Shannon Nelson <snelson@...sando.io>
To:     davem@...emloft.net, netdev@...r.kernel.org, kuba@...nel.org
Cc:     drivers@...sando.io, Brett Creeley <brett@...sando.io>,
        Shannon Nelson <snelson@...sando.io>
Subject: [PATCH net 13/16] ionic: disable napi when ionic_lif_init() fails

From: Brett Creeley <brett@...sando.io>

When the driver is going through reset, it will eventually call
ionic_lif_init(), which does a lot of re-initialization. One
of the re-initialization steps is to setup the adminq and
enable napi for it.  If something breaks after this point
we can end up with a kernel NULL pointer dereference through
ionic_adminq_napi.

Fix this by making sure to call napi_disable() in the cleanup
path of ionic_lif_init().  This forces any pending napi contexts
to finish and prevents them from being recalled before deleting
the napi context.

Fixes: 77ceb68e29cc ("ionic: Add notifyq support")
Signed-off-by: Brett Creeley <brett@...sando.io>
Signed-off-by: Shannon Nelson <snelson@...sando.io>
---
 drivers/net/ethernet/pensando/ionic/ionic_lif.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index adee1b129e92..c9535f4863ba 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -3266,6 +3266,7 @@ int ionic_lif_init(struct ionic_lif *lif)
 	return 0;

 err_out_notifyq_deinit:
+	napi_disable(&lif->adminqcq->napi);
 	ionic_lif_qcq_deinit(lif, lif->notifyqcq);
 err_out_adminq_deinit:
 	ionic_lif_qcq_deinit(lif, lif->adminqcq);
-- 
2.17.1