Patch "rocker: fix possible null pointer dereference in rocker_router_fib_event_work" has been added to the 4.15-stable tree
Subsystems (3)
This is a note to let you know that I've just added the patch titled
rocker: fix possible null pointer dereference in rocker_router_fib_event_work
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rocker-fix-possible-null-pointer-dereference-in-rocker_router_fib_event_work.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Wed Feb 7 11:29:33 PST 2018
From: Jiri Pirko <[email protected]>
Date: Thu, 1 Feb 2018 12:21:15 +0100
Subject: rocker: fix possible null pointer dereference in rocker_router_fib_event_work
From: Jiri Pirko <[email protected]>
[ Upstream commit a83165f00f16c0e0ef5b7cec3cbd0d4788699265 ]
Currently, rocker user may experience following null pointer derefence bug:
[ 3.062141] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0 [ 3.065163] IP: rocker_router_fib_event_work+0x36/0x110 [rocker]
The problem is uninitialized rocker->wops pointer that is initialized only with the first initialized port. So move the port initialization before registering the fib events.
--- drivers/net/ethernet/rocker/rocker_main.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/ethernet/rocker/rocker_main.c +9 -9
@@ -2902,6 +2902,12 @@ static int rocker_probe(struct pci_dev * goto err_alloc_ordered_workqueue; } + err =rocker_probe_ports (rocker); +if (err) { +dev_err (&pdev->dev,"failed to probe ports\n" ); + goto err_probe_ports; + } +/* Only FIBs pointing to our own netdevs are programmed into * the device, so no need to pass a callback. */
@@ -2918,22 +2924,16 @@ static int rocker_probe(struct pci_dev * rocker->hw.id =rocker_read64 (rocker,SWITCH_ID ); - err =rocker_probe_ports (rocker); -if (err) { -dev_err (&pdev->dev,"failed to probe ports\n" ); - goto err_probe_ports; - } -dev_info (&pdev->dev,"Rocker switch with id %*phN\n" , (int )sizeof (rocker->hw.id), &rocker->hw.id);return 0 ; -err_probe_ports: -unregister_switchdev_notifier (&rocker_switchdev_notifier); err_register_switchdev_notifier:unregister_fib_notifier (&rocker->fib_nb); err_register_fib_notifier: +rocker_remove_ports (rocker); +err_probe_ports:destroy_workqueue (rocker->rocker_owq); err_alloc_ordered_workqueue:free_irq (rocker_msix_vector (rocker,ROCKER_MSIX_VEC_EVENT ), rocker);
@@ -2961,9 +2961,9 @@ static void rocker_remove(struct pci_dev {struct rocker *rocker =pci_get_drvdata (pdev); -rocker_remove_ports (rocker);unregister_switchdev_notifier (&rocker_switchdev_notifier);unregister_fib_notifier (&rocker->fib_nb); +rocker_remove_ports (rocker);rocker_write32 (rocker,CONTROL ,ROCKER_CONTROL_RESET );destroy_workqueue (rocker->rocker_owq);free_irq (rocker_msix_vector (rocker,ROCKER_MSIX_VEC_EVENT ), rocker);
Patches currently in stable-queue which might be from [email protected] are
queue-4.15/net_sched-get-rid-of-rcu_barrier-in-tcf_block_put_ext.patch queue-4.15/rocker-fix-possible-null-pointer-dereference-in-rocker_router_fib_event_work.patch queue-4.15/net-sched-fix-use-after-free-in-tcf_block_put_ext.patch