diff mbox series

[net] ethernet: alx: fix order of calls on resume

Message ID 20210305221729.206096-1-kuba@kernel.org
State Accepted
Commit a4dcfbc4ee2218abd567d81d795082d8d4afcdf6
Headers show
Series [net] ethernet: alx: fix order of calls on resume | expand

Commit Message

Jakub Kicinski March 5, 2021, 10:17 p.m. UTC
netif_device_attach() will unpause the queues so we can't call
it before __alx_open(). This went undetected until
commit b0999223f224 ("alx: add ability to allocate and free
alx_napi structures") but now if stack tries to xmit immediately
on resume before __alx_open() we'll crash on the NAPI being null:

 BUG: kernel NULL pointer dereference, address: 0000000000000198
 CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G           OE 5.10.0-3-amd64 #1 Debian 5.10.13-1
 Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77-D3H, BIOS F15 11/14/2013
 RIP: 0010:alx_start_xmit+0x34/0x650 [alx]
 Code: 41 56 41 55 41 54 55 53 48 83 ec 20 0f b7 57 7c 8b 8e b0
0b 00 00 39 ca 72 06 89 d0 31 d2 f7 f1 89 d2 48 8b 84 df
 RSP: 0018:ffffb09240083d28 EFLAGS: 00010297
 RAX: 0000000000000000 RBX: ffffa04d80ae7800 RCX: 0000000000000004
 RDX: 0000000000000000 RSI: ffffa04d80afa000 RDI: ffffa04e92e92a00
 RBP: 0000000000000042 R08: 0000000000000100 R09: ffffa04ea3146700
 R10: 0000000000000014 R11: 0000000000000000 R12: ffffa04e92e92100
 R13: 0000000000000001 R14: ffffa04e92e92a00 R15: ffffa04e92e92a00
 FS:  0000000000000000(0000) GS:ffffa0508f600000(0000) knlGS:0000000000000000
 i915 0000:00:02.0: vblank wait timed out on crtc 0
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000198 CR3: 000000004460a001 CR4: 00000000001706f0
 Call Trace:
  dev_hard_start_xmit+0xc7/0x1e0
  sch_direct_xmit+0x10f/0x310

Cc: <stable@vger.kernel.org> # 4.9+
Fixes: bc2bebe8de8e ("alx: remove WoL support")
Reported-by: Zbynek Michl <zbynek.michl@gmail.com>
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983595
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
 drivers/net/ethernet/atheros/alx/main.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Jakub Kicinski March 5, 2021, 10:19 p.m. UTC | #1
On Fri,  5 Mar 2021 14:17:29 -0800 Jakub Kicinski wrote:
> netif_device_attach() will unpause the queues so we can't call
> it before __alx_open(). This went undetected until
> commit b0999223f224 ("alx: add ability to allocate and free
> alx_napi structures") but now if stack tries to xmit immediately
> on resume before __alx_open() we'll crash on the NAPI being null:

> Cc: <stable@vger.kernel.org> # 4.9+
> Fixes: bc2bebe8de8e ("alx: remove WoL support")
> Reported-by: Zbynek Michl <zbynek.michl@gmail.com>
> Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983595
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

I should have also added:

Tested-by: Zbynek Michl <zbynek.michl@gmail.com>
patchwork-bot+netdevbpf@kernel.org March 5, 2021, 11:10 p.m. UTC | #2
Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Fri,  5 Mar 2021 14:17:29 -0800 you wrote:
> netif_device_attach() will unpause the queues so we can't call
> it before __alx_open(). This went undetected until
> commit b0999223f224 ("alx: add ability to allocate and free
> alx_napi structures") but now if stack tries to xmit immediately
> on resume before __alx_open() we'll crash on the NAPI being null:
> 
>  BUG: kernel NULL pointer dereference, address: 0000000000000198
>  CPU: 0 PID: 12 Comm: ksoftirqd/0 Tainted: G           OE 5.10.0-3-amd64 #1 Debian 5.10.13-1
>  Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77-D3H, BIOS F15 11/14/2013
>  RIP: 0010:alx_start_xmit+0x34/0x650 [alx]
>  Code: 41 56 41 55 41 54 55 53 48 83 ec 20 0f b7 57 7c 8b 8e b0
> 0b 00 00 39 ca 72 06 89 d0 31 d2 f7 f1 89 d2 48 8b 84 df
>  RSP: 0018:ffffb09240083d28 EFLAGS: 00010297
>  RAX: 0000000000000000 RBX: ffffa04d80ae7800 RCX: 0000000000000004
>  RDX: 0000000000000000 RSI: ffffa04d80afa000 RDI: ffffa04e92e92a00
>  RBP: 0000000000000042 R08: 0000000000000100 R09: ffffa04ea3146700
>  R10: 0000000000000014 R11: 0000000000000000 R12: ffffa04e92e92100
>  R13: 0000000000000001 R14: ffffa04e92e92a00 R15: ffffa04e92e92a00
>  FS:  0000000000000000(0000) GS:ffffa0508f600000(0000) knlGS:0000000000000000
>  i915 0000:00:02.0: vblank wait timed out on crtc 0
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: 0000000000000198 CR3: 000000004460a001 CR4: 00000000001706f0
>  Call Trace:
>   dev_hard_start_xmit+0xc7/0x1e0
>   sch_direct_xmit+0x10f/0x310
> 
> [...]

Here is the summary with links:
  - [net] ethernet: alx: fix order of calls on resume
    https://git.kernel.org/netdev/net/c/a4dcfbc4ee22

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 9b7f1af5f574..9e02f8864593 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1894,13 +1894,16 @@  static int alx_resume(struct device *dev)
 
 	if (!netif_running(alx->dev))
 		return 0;
-	netif_device_attach(alx->dev);
 
 	rtnl_lock();
 	err = __alx_open(alx, true);
 	rtnl_unlock();
+	if (err)
+		return err;
 
-	return err;
+	netif_device_attach(alx->dev);
+
+	return 0;
 }
 
 static SIMPLE_DEV_PM_OPS(alx_pm_ops, alx_suspend, alx_resume);