From 7fb1c2ac8ecaf0883f2fcb38dfc9ec2d15cee11d Mon Sep 17 00:00:00 2001 From: Brian King Date: Wed, 14 May 2008 09:48:25 -0500 Subject: ehea: Fix use after free on reboot Fixes the following use after free oops: ehea: Reboot: freeing all eHEA resources Unable to handle kernel paging request for data at address 0x6b6b6b6b6b6b6c5b Faulting instruction address: 0xd000000000354488 cpu 0x0: Vector: 300 (Data Access) at [c00000002ec6f310] pc: d000000000354488: .ehea_shutdown_single_port+0x50/0x78 [ehea] lr: d00000000035447c: .ehea_shutdown_single_port+0x44/0x78 [ehea] sp: c00000002ec6f590 msr: 8000000000009032 dar: 6b6b6b6b6b6b6c5b dsisr: 40000000 current = 0xc0000000281412e0 paca = 0xc0000000006df300 pid = 10930, comm = reboot enter ? for help [c00000002ec6f590] d00000000035d64c .ehea_remove+0x44/0x124 [ehea] (unreliable) [c00000002ec6f630] c000000000319f88 .of_platform_device_remove+0x40/0x58 [c00000002ec6f6a0] c000000000291018 .__device_release_driver+0xb0/0xf0 [c00000002ec6f730] c000000000291120 .driver_detach+0xc8/0xfc [c00000002ec6f7c0] c00000000028fe24 .bus_remove_driver+0xb4/0x114 [c00000002ec6f850] c000000000291768 .driver_unregister+0x54/0x74 [c00000002ec6f8e0] c00000000031a0c8 .of_unregister_driver+0x14/0x28 [c00000002ec6f950] c000000000023ba0 .ibmebus_unregister_driver+0x10/0x24 [c00000002ec6f9c0] d000000000354180 .ehea_reboot_notifier+0x30/0x4c [ehea] [c00000002ec6fa40] c0000000003c95a8 .notifier_call_chain+0x5c/0xcc [c00000002ec6fae0] c000000000082cd4 .__blocking_notifier_call_chain+0x70/0xb0 [c00000002ec6fb90] c000000000075cf8 .kernel_restart_prepare+0x24/0x58 [c00000002ec6fc10] c000000000075f0c .kernel_restart+0x20/0x6c [c00000002ec6fc90] c000000000078674 .sys_reboot+0x1d4/0x290 [c00000002ec6fe30] c0000000000086ac syscall_exit+0x0/0x40 Signed-off-by: Jeff Garzik --- drivers/net/ehea/ehea_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/net/ehea/ehea_main.c') diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c index d1b6d4e7495d..8645224da1cf 100644 --- a/drivers/net/ehea/ehea_main.c +++ b/drivers/net/ehea/ehea_main.c @@ -3178,11 +3178,12 @@ out_err: static void ehea_shutdown_single_port(struct ehea_port *port) { + struct ehea_adapter *adapter = port->adapter; unregister_netdev(port->netdev); ehea_unregister_port(port); kfree(port->mc_list); free_netdev(port->netdev); - port->adapter->active_ports--; + adapter->active_ports--; } static int ehea_setup_ports(struct ehea_adapter *adapter) -- cgit v1.2.3 From 25c16fffa8ed82d3ef31980d76ff95d3c6430f00 Mon Sep 17 00:00:00 2001 From: Joe Perches Date: Mon, 12 May 2008 14:38:17 -0700 Subject: drivers/net/ehea - remove unnecessary memset after kzalloc Signed-off-by: Joe Perches Signed-off-by: Jeff Garzik --- drivers/net/ehea/ehea_main.c | 2 -- 1 file changed, 2 deletions(-) (limited to 'drivers/net/ehea/ehea_main.c') diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c index 8645224da1cf..287a61918739 100644 --- a/drivers/net/ehea/ehea_main.c +++ b/drivers/net/ehea/ehea_main.c @@ -2213,8 +2213,6 @@ static void ehea_vlan_rx_register(struct net_device *dev, goto out; } - memset(cb1->vlan_filter, 0, sizeof(cb1->vlan_filter)); - hret = ehea_h_modify_ehea_port(adapter->handle, port->logical_port_id, H_PORT_CB1, H_PORT_CB1_ALL, cb1); if (hret != H_SUCCESS) -- cgit v1.2.3 From 00aaea2f95d73d4e2b5e45cf77c3cbb16c59e87f Mon Sep 17 00:00:00 2001 From: Jan-Bernd Themann Date: Mon, 9 Jun 2008 15:17:37 +0100 Subject: ehea: set mac address fix eHEA has to call firmware functions in order to change the mac address of a logical port. This patch checks if the logical port is up when calling the register / deregister mac address calls. If the port is down these firmware calls would fail and are therefore not executed. Signed-off-by: Jan-Bernd Themann Signed-off-by: Jeff Garzik --- drivers/net/ehea/ehea_main.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) (limited to 'drivers/net/ehea/ehea_main.c') diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c index 287a61918739..faae01dc1c4b 100644 --- a/drivers/net/ehea/ehea_main.c +++ b/drivers/net/ehea/ehea_main.c @@ -1766,16 +1766,20 @@ static int ehea_set_mac_addr(struct net_device *dev, void *sa) mutex_lock(&ehea_bcmc_regs.lock); /* Deregister old MAC in pHYP */ - ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC); - if (ret) - goto out_upregs; + if (port->state == EHEA_PORT_UP) { + ret = ehea_broadcast_reg_helper(port, H_DEREG_BCMC); + if (ret) + goto out_upregs; + } port->mac_addr = cb0->port_mac_addr << 16; /* Register new MAC in pHYP */ - ret = ehea_broadcast_reg_helper(port, H_REG_BCMC); - if (ret) - goto out_upregs; + if (port->state == EHEA_PORT_UP) { + ret = ehea_broadcast_reg_helper(port, H_REG_BCMC); + if (ret) + goto out_upregs; + } ret = 0; -- cgit v1.2.3 From 4bb073c0e32a0862bdb5215d11af19f6c0180c98 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Thu, 12 Jun 2008 02:22:02 -0700 Subject: net: Eliminate flush_scheduled_work() calls while RTNL is held. If the RTNL is held when we invoke flush_scheduled_work() we could deadlock. One such case is linkwatch, it is a work struct which tries to grab the RTNL semaphore. The most common case are net driver ->stop() methods. The simplest conversion is to instead use cancel_{delayed_}work_sync() explicitly on the various work struct the driver uses. This is an OK transformation because these work structs are doing things like resetting the chip, restarting link negotiation, and so forth. And if we're bringing down the device, we're about to turn the chip off and reset it anways. So if we cancel a pending work event, that's fine here. Some drivers were working around this deadlock by using a msleep() polling loop of some sort, and those cases are converted to instead use cancel_{delayed_}work_sync() as well. Signed-off-by: David S. Miller --- drivers/net/ehea/ehea_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/net/ehea/ehea_main.c') diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c index faae01dc1c4b..075fd547421e 100644 --- a/drivers/net/ehea/ehea_main.c +++ b/drivers/net/ehea/ehea_main.c @@ -2605,7 +2605,8 @@ static int ehea_stop(struct net_device *dev) if (netif_msg_ifdown(port)) ehea_info("disabling port %s", dev->name); - flush_scheduled_work(); + cancel_work_sync(&port->reset_task); + mutex_lock(&port->port_lock); netif_stop_queue(dev); port_napi_disable(port); -- cgit v1.2.3