diff mbox series

[S44,13/14] ice: fix kernel BUG if register_netdev fails

Message ID 20200516004226.4795-13-anthony.l.nguyen@intel.com
State Accepted
Delegated to: Jeff Kirsher
Headers show
Series [S44,01/14] ice: Don't allow VLAN stripping change when pvid set | expand

Commit Message

Tony Nguyen May 16, 2020, 12:42 a.m. UTC 
From: Jacob Keller <jacob.e.keller@intel.com>

If register_netdev() fails, the driver will attempt to cleanup the
q_vectors and inadvertently trigger a kernel BUG due to a NULL pointer
dereference.

This occurs because cleaning up q_vectors attempts to call
netif_napi_del on napi_structs which were never initialized.

Resolve this by releasing the netdev in ice_cfg_netdev and setting
vsi->netdev to NULL. This ensures that after ice_cfg_netdev fails the
state is rewound to match as if ice_cfg_netdev was never called.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
---
 drivers/net/ethernet/intel/ice/ice_main.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Bowers, AndrewX May 26, 2020, 8:26 p.m. UTC | #1 
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of
> Tony Nguyen
> Sent: Friday, May 15, 2020 5:42 PM
> To: intel-wired-lan@lists.osuosl.org
> Subject: [Intel-wired-lan] [PATCH S44 13/14] ice: fix kernel BUG if
> register_netdev fails
> 
> From: Jacob Keller <jacob.e.keller@intel.com>
> 
> If register_netdev() fails, the driver will attempt to cleanup the q_vectors
> and inadvertently trigger a kernel BUG due to a NULL pointer dereference.
> 
> This occurs because cleaning up q_vectors attempts to call netif_napi_del on
> napi_structs which were never initialized.
> 
> Resolve this by releasing the netdev in ice_cfg_netdev and setting
> vsi->netdev to NULL. This ensures that after ice_cfg_netdev fails the
> state is rewound to match as if ice_cfg_netdev was never called.
> 
> Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
> ---
>  drivers/net/ethernet/intel/ice/ice_main.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)

Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
diff mbox series

Patch

diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 943fde5abdb7..14aa02b000cc 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -2435,7 +2435,7 @@  static int ice_cfg_netdev(struct ice_vsi *vsi)
 
 	err = register_netdev(vsi->netdev);
 	if (err)
-		goto err_destroy_devlink_port;
+		goto err_free_netdev;
 
 	devlink_port_type_eth_set(&pf->devlink_port, vsi->netdev);
 
@@ -2446,9 +2446,11 @@  static int ice_cfg_netdev(struct ice_vsi *vsi)
 
 	return 0;
 
+err_free_netdev:
+	free_netdev(vsi->netdev);
+	vsi->netdev = NULL;
 err_destroy_devlink_port:
 	ice_devlink_destroy_port(pf);
-
 	return err;
 }