github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 13:37:36 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
ba2716da23
linux/drivers
History
Manuel Ullmann ba2716da23 net: atlantic: invert deep par in pm functions, preventing null derefs 
commit cbe6c3a8f8 upstream.

This will reset deeply on freeze and thaw instead of suspend and
resume and prevent null pointer dereferences of the uninitialized ring
0 buffer while thawing.

The impact is an indefinitely hanging kernel. You can't switch
consoles after this and the only possible user interaction is SysRq.

BUG: kernel NULL pointer dereference
RIP: 0010:aq_ring_rx_fill+0xcf/0x210 [atlantic]
aq_vec_init+0x85/0xe0 [atlantic]
aq_nic_init+0xf7/0x1d0 [atlantic]
atl_resume_common+0x4f/0x100 [atlantic]
pci_pm_thaw+0x42/0xa0

resolves in aq_ring.o to

```
0000000000000ae0 <aq_ring_rx_fill>:
{
/* ... */
 baf:	48 8b 43 08          	mov    0x8(%rbx),%rax
 		buff->flags = 0U; /* buff is NULL */
```

The bug has been present since the introduction of the new pm code in
8aaa112a57 ("net: atlantic: refactoring pm logic") and was hidden
until 8ce8427169 ("net: atlantic: changes for multi-TC support"),
which refactored the aq_vec_{free,alloc} functions into
aq_vec_{,ring}_{free,alloc}, but is technically not wrong. The
original functions just always reinitialized the buffers on S3/S4. If
the interface is down before freezing, the bug does not occur. It does
not matter, whether the initrd contains and loads the module before
thawing.

So the fix is to invert the boolean parameter deep in all pm function
calls, which was clearly intended to be set like that.

First report was on Github [1], which you have to guess from the
resume logs in the posted dmesg snippet. Recently I posted one on
Bugzilla [2], since I did not have an AQC device so far.

#regzbot introduced: 8ce8427169
#regzbot from: koo5 <kolman.jindrich@gmail.com>
#regzbot monitor: https://github.com/Aquantia/AQtion/issues/32

Fixes: 8aaa112a57 ("net: atlantic: refactoring pm logic")
Link: https://github.com/Aquantia/AQtion/issues/32 [1]
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215798 [2]
Cc: stable@vger.kernel.org
Reported-by: koo5 <kolman.jindrich@gmail.com>
Signed-off-by: Manuel Ullmann <labre@posteo.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-27 13:53:55 +02:00
..
accessibility speakup-dectlk: Restore pitch setting 2022-02-16 12:54:30 +01:00
acpi ACPI: processor idle: Check for architectural support for LPI 2022-04-20 09:23:09 +02:00
amba amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
android binder: fix handling of error during copy 2022-01-27 10:54:06 +01:00
ata ata: pata_marvell: Check the 'bmdma_addr' beforing reading 2022-04-27 13:53:54 +02:00
atm atm: eni: Add check for dma_map_single 2022-03-23 09:13:27 +01:00
auxdisplay auxdisplay: ht16k33: Fix frame buffer device blanking 2021-11-18 14:04:24 +01:00
base PM: core: keep irq flags in device_pm_check_callbacks() 2022-04-08 14:40:32 +02:00
bcma bcma: Fix memory leak for internally-handled cores 2021-09-15 09:50:45 +02:00
block drbd: Fix five use after free bugs in get_initial_state 2022-04-13 21:01:06 +02:00
bluetooth Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt 2022-04-08 14:40:22 +02:00
bus mips: cdmm: Fix refcount leak in mips_cdmm_phys_base 2022-04-08 14:40:20 +02:00
cdrom cdrom: gdrom: initialize global variable at init time 2021-05-26 12:06:55 +02:00
char virtio_console: eliminate anonymous module_init & module_exit 2022-04-13 21:01:02 +02:00
clk clk: Enforce that disjoints limits are invalid 2022-04-13 21:01:02 +02:00
clocksource clocksource: acpi_pm: fix return value of __setup handler 2022-04-08 14:40:03 +02:00
connector
counter counter: stm32-lptimer-cnt: remove iio counter abi 2022-01-27 10:54:08 +01:00
cpufreq cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse 2022-04-08 14:40:24 +02:00
cpuidle cpuidle: Fix kobject memory leaks in error paths 2021-11-18 14:04:05 +01:00
crypto crypto: ccree - Fix use after free in cc_cipher_exit() 2022-04-08 14:40:02 +02:00
dax dax: make sure inodes are flushed before destroy cache 2022-04-08 14:40:16 +02:00
dca
devfreq PM / devfreq: Add missing error code in devfreq_add_device() 2021-07-14 16:56:11 +02:00
dio
dma dma: at_xdmac: fix a missing check on list iterator 2022-04-27 13:53:55 +02:00
dma-buf udmabuf: validate ubuf->pagecount 2022-04-08 14:40:12 +02:00
edac EDAC/synopsys: Read the error count from the correct register 2022-04-27 13:53:54 +02:00
eisa
extcon extcon: intel-mrfld: Sync hardware and software state on init 2021-07-19 09:45:00 +02:00
firewire
firmware firmware: arm_scmi: Fix sorting of retrieved clock rates 2022-04-20 09:23:10 +02:00
fpga fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() 2021-09-30 10:11:04 +02:00
fsi fsi: Aspeed: Fix a potential double free 2022-04-08 14:40:23 +02:00
gnss
gpio gpiolib: acpi: use correct format characters 2022-04-20 09:23:11 +02:00
gpu drm/msm/mdp5: check the return of kzalloc() 2022-04-27 13:53:53 +02:00
greybus greybus: svc: fix an error handling bug in gb_svc_hello() 2022-04-08 14:39:50 +02:00
hid HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports 2022-04-08 14:40:15 +02:00
hsi HSI: core: Fix return freed object in hsi_new_client 2022-01-27 10:54:12 +01:00
hv Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer 2022-04-20 09:23:20 +02:00
hwmon hwmon: (pmbus) Add Vin unit off handling 2022-04-08 14:40:02 +02:00
hwspinlock
hwtracing amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
i2c i2c: pasemi: Wait for write xfers to finish 2022-04-20 09:23:30 +02:00
i3c
ide
idle
iio iio: adc: Add check for devm_request_threaded_irq 2022-04-08 14:40:25 +02:00
infiniband scsi: iscsi: Rel ref after iscsi_lookup_endpoint() 2022-04-20 09:23:16 +02:00
input amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
interconnect treewide: Change list_sort to use const pointers 2021-09-30 10:11:04 +02:00
iommu iommu/omap: Fix regression in probe for NULL pointer dereference 2022-04-13 21:01:07 +02:00
ipack ipack: ipoctal: fix module reference leak 2021-10-06 15:56:01 +02:00
irqchip irqchip/gic, gic-v3: Prevent GSI to SGI translations 2022-04-13 21:01:11 +02:00
isdn isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() 2022-03-16 14:15:57 +01:00
leds leds: trigger: audio: Add an activate callback to ensure the initial brightness is set 2021-09-15 09:50:36 +02:00
lightnvm
macintosh
mailbox mailbox: imx: fix wakeup failure from freeze mode 2022-04-08 14:40:41 +02:00
mcb mcb: fix error handling in mcb_alloc_bus() 2021-09-30 10:11:00 +02:00
md dm: fix mempool NULL pointer race when completing IO 2022-04-27 13:53:47 +02:00
media media: rockchip/rga: do proper error checking in probe 2022-04-20 09:23:10 +02:00
memory memory: renesas-rpc-if: fix platform-device leak in error path 2022-04-20 09:23:26 +02:00
memstick memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host() 2021-11-18 14:04:07 +01:00
message
mfd mfd: asic3: Add missing iounmap() on error asic3_mfd_probe 2022-04-08 14:40:23 +02:00
misc kgdbts: fix return value of __setup handler 2022-04-08 14:40:28 +02:00
mmc mmc: renesas_sdhi: don't overwrite TAP settings when HS400 tuning is complete 2022-04-13 21:01:07 +02:00
most most: fix control-message timeouts 2021-11-18 14:03:51 +01:00
mtd ubi: fastmap: Return error code if memory allocation fails in add_aeb() 2022-04-08 14:40:43 +02:00
mux
net net: atlantic: invert deep par in pm functions, preventing null derefs 2022-04-27 13:53:55 +02:00
nfc nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION 2022-03-28 09:57:07 +02:00
ntb ntb: intel: fix port config status offset for SPR 2022-03-08 19:09:32 +01:00
nubus
nvdimm nvdimm/region: Fix default alignment for small regions 2022-04-08 14:40:26 +02:00
nvme nvme-pci: disable namespace identifiers for Qemu controllers 2022-04-27 13:53:54 +02:00
nvmem nvmem: core: set size for sysfs bin file 2022-01-27 10:54:22 +01:00
of of: base: Improve argument length mismatch error 2022-01-27 10:54:28 +01:00
opp opp: Fix return in _opp_add_static_v2() 2021-11-18 14:04:22 +01:00
oprofile
parisc parisc: Fix CPU affinity for Lasi, WAX and Dino chips 2022-04-13 21:01:03 +02:00
parport parport: remove non-zero check on count 2021-09-18 13:40:34 +02:00
pci PCI: endpoint: Fix misused goto label 2022-04-13 21:00:59 +02:00
pcmcia pcmcia: fix setting of kthread task states 2022-01-27 10:54:03 +01:00
perf perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant 2022-04-20 09:23:24 +02:00
phy phy: amlogic: meson8b-usb2: Use dev_err_probe() 2022-04-13 21:01:01 +02:00
pinctrl pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE() 2022-04-08 14:40:41 +02:00
platform platform/x86: samsung-laptop: Fix an unsigned comparison which can never be negative 2022-04-27 13:53:53 +02:00
pnp
power power: supply: axp288-charger: Set Vhold to 4.4V 2022-04-13 21:00:57 +02:00
powercap
pps
ps3
ptp ptp: replace snprintf with sysfs_emit 2022-04-13 21:00:55 +02:00
pwm pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add() 2022-04-08 14:40:23 +02:00
rapidio rapidio: handle create_workqueue() failure 2021-05-26 12:06:52 +02:00
ras
regulator regulator: wm8994: Add an off-on delay for WM8994 variant 2022-04-20 09:23:22 +02:00
remoteproc remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region 2022-04-08 14:40:26 +02:00
reset reset: tegra-bpmp: Restore Handle errors in BPMP response 2022-04-27 13:53:52 +02:00
rpmsg rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev 2022-02-01 17:25:43 +01:00
rtc rtc: wm8350: Handle error for wm8350_register_irq 2022-04-13 21:00:54 +02:00
s390 scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices 2022-02-01 17:25:39 +01:00
sbus
scsi scsi: qedi: Fix failed disconnect handling 2022-04-27 13:53:54 +02:00
sfi
sh maple: fix wrong return value of maple_bus_init(). 2021-11-26 10:39:12 +01:00
siox
slimbus slimbus: ngd: reset dma setup during runtime pm 2021-08-26 08:35:55 -04:00
soc soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe 2022-04-08 14:40:07 +02:00
soundwire soundwire: intel: fix wrong register name in intel_shim_wake 2022-04-08 14:40:24 +02:00
spi spi: spi-mtk-nor: initialize spi controller after resume 2022-04-27 13:53:48 +02:00
spmi
ssb ssb: Fix error return code in ssb_bus_scan() 2021-07-14 16:56:21 +02:00
staging staging: wfx: fix an error handling in wfx_init_common() 2022-04-13 21:01:01 +02:00
target scsi: target: tcmu: Fix possible page UAF 2022-04-20 09:23:21 +02:00
tc
tee optee: use driver internal tee_context for some rpc 2022-03-02 11:42:47 +01:00
thermal thermal: int340x: Check for NULL after calling kmemdup() 2022-04-08 14:39:59 +02:00
thunderbolt thunderbolt: Runtime PM activate both ends of the device link 2022-01-27 10:54:14 +01:00
tty serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() 2022-04-13 21:01:02 +02:00
uio uio_hv_generic: Fix a memory leak in error handling paths 2021-05-26 12:06:52 +02:00
usb usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm 2022-04-13 21:01:00 +02:00
vdpa vdpa/mlx5: should verify CTRL_VQ feature exists for MQ 2022-04-08 14:39:47 +02:00
vfio amba: Make the remove callback return void 2022-04-08 14:40:02 +02:00
vhost tuntap: add sanity checks about msg_controllen in sendmsg 2022-04-13 21:00:59 +02:00
video video: fbdev: sm712fb: Fix crash in smtcfb_write() 2022-04-08 14:40:36 +02:00
virt
virtio virtio: acknowledge all features before access 2022-03-16 14:16:02 +01:00
visorbus visorbus: fix error return code in visorchipset_init() 2021-07-14 16:56:41 +02:00
vlynq
vme
w1 w1: w1_therm: fixes w1_seq for ds28ea00 sensors 2022-04-13 21:01:01 +02:00
watchdog watchdog: rti-wdt: Add missing pm_runtime_disable() in probe function 2022-04-08 14:40:41 +02:00
xen xen/gnttab: fix gnttab_end_foreign_access() without page specified 2022-03-11 12:11:54 +01:00
zorro
Kconfig
Makefile