diff mbox series

fjes: Handle workqueue allocation failure

Message ID 20210219191643.16883-2-tim.gardner@canonical.com
State New
Headers show
Series fjes: Handle workqueue allocation failure | expand

Commit Message

Tim Gardner Feb. 19, 2021, 7:16 p.m. UTC
From: Will Deacon <will@kernel.org>

In the highly unlikely event that we fail to allocate either of the
"/txrx" or "/control" workqueues, we should bail cleanly rather than
blindly march on with NULL queue pointer(s) installed in the
'fjes_adapter' instance.

Cc: "David S. Miller" <davem@davemloft.net>
Reported-by: Nicolas Waisman <nico@semmle.com>
Link: https://lore.kernel.org/lkml/CADJ_3a8WFrs5NouXNqS5WYe7rebFP+_A5CheeqAyD_p7DFJJcg@mail.gmail.com/
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
CVE-2019-16231
[backported from 85ac30fa2e24f628e9f4f9344460f4015d33fd7d]
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
 drivers/net/fjes/fjes_main.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

Comments

Thadeu Lima de Souza Cascardo Feb. 19, 2021, 8:57 p.m. UTC | #1
On Fri, Feb 19, 2021 at 12:16:43PM -0700, Tim Gardner wrote:
> From: Will Deacon <will@kernel.org>
> 
> In the highly unlikely event that we fail to allocate either of the
> "/txrx" or "/control" workqueues, we should bail cleanly rather than
> blindly march on with NULL queue pointer(s) installed in the
> 'fjes_adapter' instance.
> 
> Cc: "David S. Miller" <davem@davemloft.net>
> Reported-by: Nicolas Waisman <nico@semmle.com>
> Link: https://lore.kernel.org/lkml/CADJ_3a8WFrs5NouXNqS5WYe7rebFP+_A5CheeqAyD_p7DFJJcg@mail.gmail.com/
> Signed-off-by: Will Deacon <will@kernel.org>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> CVE-2019-16231
> [backported from 85ac30fa2e24f628e9f4f9344460f4015d33fd7d]
> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Thanks, Tim.

I confirmed the backport line will be matched by cve-tools, when doing autotriage.

Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

> ---
>  drivers/net/fjes/fjes_main.c | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
> index d8fcdc2414d8..f22dc23f8548 100644
> --- a/drivers/net/fjes/fjes_main.c
> +++ b/drivers/net/fjes/fjes_main.c
> @@ -1119,7 +1119,16 @@ static int fjes_probe(struct platform_device *plat_dev)
>  	adapter->open_guard = false;
>  
>  	adapter->txrx_wq = create_workqueue(DRV_NAME "/txrx");
> +	if (unlikely(!adapter->txrx_wq)) {
> +		err = -ENOMEM;
> +		goto err_free_netdev;
> +	}
> +
>  	adapter->control_wq = create_workqueue(DRV_NAME "/control");
> +	if (unlikely(!adapter->control_wq)) {
> +		err = -ENOMEM;
> +		goto err_free_txrx_wq;
> +	}
>  
>  	INIT_WORK(&adapter->tx_stall_task, fjes_tx_stall_task);
>  	INIT_WORK(&adapter->raise_intr_rxdata_task,
> @@ -1136,7 +1145,7 @@ static int fjes_probe(struct platform_device *plat_dev)
>  	hw->hw_res.irq = platform_get_irq(plat_dev, 0);
>  	err = fjes_hw_init(&adapter->hw);
>  	if (err)
> -		goto err_free_netdev;
> +		goto err_free_control_wq;
>  
>  	/* setup MAC address (02:00:00:00:00:[epid])*/
>  	netdev->dev_addr[0] = 2;
> @@ -1156,6 +1165,10 @@ static int fjes_probe(struct platform_device *plat_dev)
>  
>  err_hw_exit:
>  	fjes_hw_exit(&adapter->hw);
> +err_free_control_wq:
> +	destroy_workqueue(adapter->control_wq);
> +err_free_txrx_wq:
> +	destroy_workqueue(adapter->txrx_wq);
>  err_free_netdev:
>  	free_netdev(netdev);
>  err_out:
> -- 
> 2.17.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
Stefan Bader Feb. 22, 2021, 8:28 a.m. UTC | #2
On 19.02.21 20:16, Tim Gardner wrote:
> From: Will Deacon <will@kernel.org>
> 
> In the highly unlikely event that we fail to allocate either of the
> "/txrx" or "/control" workqueues, we should bail cleanly rather than
> blindly march on with NULL queue pointer(s) installed in the
> 'fjes_adapter' instance.
> 
> Cc: "David S. Miller" <davem@davemloft.net>
> Reported-by: Nicolas Waisman <nico@semmle.com>
> Link: https://lore.kernel.org/lkml/CADJ_3a8WFrs5NouXNqS5WYe7rebFP+_A5CheeqAyD_p7DFJJcg@mail.gmail.com/
> Signed-off-by: Will Deacon <will@kernel.org>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> CVE-2019-16231
> [backported from 85ac30fa2e24f628e9f4f9344460f4015d33fd7d]
  ^ That should be (backported from commit ...)
    note the braces instead of the angled brackets
  We also started to add slight hinting about the backport like
  [rtg: simple context adjustments]
> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
> ---

If you let us know what kind of content, this might be adjusted when applying.
But being nice and helpful might wear off.

-Stefan

>  drivers/net/fjes/fjes_main.c | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
> index d8fcdc2414d8..f22dc23f8548 100644
> --- a/drivers/net/fjes/fjes_main.c
> +++ b/drivers/net/fjes/fjes_main.c
> @@ -1119,7 +1119,16 @@ static int fjes_probe(struct platform_device *plat_dev)
>  	adapter->open_guard = false;
>  
>  	adapter->txrx_wq = create_workqueue(DRV_NAME "/txrx");
> +	if (unlikely(!adapter->txrx_wq)) {
> +		err = -ENOMEM;
> +		goto err_free_netdev;
> +	}
> +
>  	adapter->control_wq = create_workqueue(DRV_NAME "/control");
> +	if (unlikely(!adapter->control_wq)) {
> +		err = -ENOMEM;
> +		goto err_free_txrx_wq;
> +	}
>  
>  	INIT_WORK(&adapter->tx_stall_task, fjes_tx_stall_task);
>  	INIT_WORK(&adapter->raise_intr_rxdata_task,
> @@ -1136,7 +1145,7 @@ static int fjes_probe(struct platform_device *plat_dev)
>  	hw->hw_res.irq = platform_get_irq(plat_dev, 0);
>  	err = fjes_hw_init(&adapter->hw);
>  	if (err)
> -		goto err_free_netdev;
> +		goto err_free_control_wq;
>  
>  	/* setup MAC address (02:00:00:00:00:[epid])*/
>  	netdev->dev_addr[0] = 2;
> @@ -1156,6 +1165,10 @@ static int fjes_probe(struct platform_device *plat_dev)
>  
>  err_hw_exit:
>  	fjes_hw_exit(&adapter->hw);
> +err_free_control_wq:
> +	destroy_workqueue(adapter->control_wq);
> +err_free_txrx_wq:
> +	destroy_workqueue(adapter->txrx_wq);
>  err_free_netdev:
>  	free_netdev(netdev);
>  err_out:
>
diff mbox series

Patch

diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index d8fcdc2414d8..f22dc23f8548 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -1119,7 +1119,16 @@  static int fjes_probe(struct platform_device *plat_dev)
 	adapter->open_guard = false;
 
 	adapter->txrx_wq = create_workqueue(DRV_NAME "/txrx");
+	if (unlikely(!adapter->txrx_wq)) {
+		err = -ENOMEM;
+		goto err_free_netdev;
+	}
+
 	adapter->control_wq = create_workqueue(DRV_NAME "/control");
+	if (unlikely(!adapter->control_wq)) {
+		err = -ENOMEM;
+		goto err_free_txrx_wq;
+	}
 
 	INIT_WORK(&adapter->tx_stall_task, fjes_tx_stall_task);
 	INIT_WORK(&adapter->raise_intr_rxdata_task,
@@ -1136,7 +1145,7 @@  static int fjes_probe(struct platform_device *plat_dev)
 	hw->hw_res.irq = platform_get_irq(plat_dev, 0);
 	err = fjes_hw_init(&adapter->hw);
 	if (err)
-		goto err_free_netdev;
+		goto err_free_control_wq;
 
 	/* setup MAC address (02:00:00:00:00:[epid])*/
 	netdev->dev_addr[0] = 2;
@@ -1156,6 +1165,10 @@  static int fjes_probe(struct platform_device *plat_dev)
 
 err_hw_exit:
 	fjes_hw_exit(&adapter->hw);
+err_free_control_wq:
+	destroy_workqueue(adapter->control_wq);
+err_free_txrx_wq:
+	destroy_workqueue(adapter->txrx_wq);
 err_free_netdev:
 	free_netdev(netdev);
 err_out: