linux/drivers/net
Ivan Mironov 38355a5f9a bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw
This happened when I tried to boot normal Fedora 29 system with latest
available kernel (from fedora rawhide, plus some unrelated custom
patches):

	BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
	PGD 0 P4D 0
	Oops: 0010 [#1] SMP PTI
	CPU: 6 PID: 1422 Comm: libvirtd Tainted: G          I       4.20.0-0.rc7.git3.hpsa2.1.fc29.x86_64 #1
	Hardware name: HP ProLiant BL460c G6, BIOS I24 05/21/2018
	RIP: 0010:          (null)
	Code: Bad RIP value.
	RSP: 0018:ffffa47ccdc9fbe0 EFLAGS: 00010246
	RAX: 0000000000000000 RBX: 00000000000003e8 RCX: ffffa47ccdc9fbf8
	RDX: ffffa47ccdc9fc00 RSI: ffff97d9ee7b01f8 RDI: ffff97d9f0150b80
	RBP: ffff97d9f0150b80 R08: 0000000000000000 R09: 0000000000000000
	R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003
	R13: ffff97d9ef1e53e8 R14: 0000000000000009 R15: ffff97d9f0ac6730
	FS:  00007f4d224ef700(0000) GS:ffff97d9fa200000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: ffffffffffffffd6 CR3: 00000011ece52006 CR4: 00000000000206e0
	Call Trace:
	 ? bnx2x_chip_cleanup+0x195/0x610 [bnx2x]
	 ? bnx2x_nic_unload+0x1e2/0x8f0 [bnx2x]
	 ? bnx2x_reload_if_running+0x24/0x40 [bnx2x]
	 ? bnx2x_set_features+0x79/0xa0 [bnx2x]
	 ? __netdev_update_features+0x244/0x9e0
	 ? netlink_broadcast_filtered+0x136/0x4b0
	 ? netdev_update_features+0x22/0x60
	 ? dev_disable_lro+0x1c/0xe0
	 ? devinet_sysctl_forward+0x1c6/0x211
	 ? proc_sys_call_handler+0xab/0x100
	 ? __vfs_write+0x36/0x1a0
	 ? rcu_read_lock_sched_held+0x79/0x80
	 ? rcu_sync_lockdep_assert+0x2e/0x60
	 ? __sb_start_write+0x14c/0x1b0
	 ? vfs_write+0x159/0x1c0
	 ? vfs_write+0xba/0x1c0
	 ? ksys_write+0x52/0xc0
	 ? do_syscall_64+0x60/0x1f0
	 ? entry_SYSCALL_64_after_hwframe+0x49/0xbe

After some investigation I figured out that recently added cleanup code
tries to call VLAN filtering de-initialization function which exist only
for newer hardware. Corresponding function pointer is not
set (== 0) for older hardware, namely these chips:

	#define CHIP_NUM_57710			0x164e
	#define CHIP_NUM_57711			0x164f
	#define CHIP_NUM_57711E			0x1650

And I have one of those in my test system:

	Broadcom Inc. and subsidiaries NetXtreme II BCM57711E 10-Gigabit PCIe [14e4:1650]

Function bnx2x_init_vlan_mac_fp_objs() from
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h decides whether to
initialize relevant pointers in bnx2x_sp_objs.vlan_obj or not.

This regression was introduced after v4.20-rc7, and still exists in v4.20
release.

Fixes: 04f05230c5 ("bnx2x: Remove configured vlans as part of unload sequence.")
Signed-off-by: Ivan Mironov <mironov.ivan@gmail.com>
Signed-off-by: Ivan Mironov <mironov.ivan@gmail.com>
Acked-by: Sudarsana Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-12-24 14:45:51 -08:00
..
appletalk
arcnet mm: remove include/linux/bootmem.h 2018-10-31 08:54:16 -07:00
bonding bonding: fix 802.3ad state sent to partner when unbinding slave 2018-11-30 13:21:04 -08:00
caif
can can: flexcan: use can_rx_offload_queue_sorted() for flexcan_irq_bus_*() 2018-11-09 17:33:33 +01:00
dsa net: dsa: mv88e6xxx: set ethtool regs version 2018-12-17 23:29:00 -08:00
ethernet bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw 2018-12-24 14:45:51 -08:00
fddi FDDI: defza: Make the driver version string constant 2018-11-07 21:53:31 -08:00
fjes
hamradio Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-10-24 14:43:41 +01:00
hippi
hyperv hv_netvsc: fix vf serial matching with pci slot info 2018-10-15 22:58:11 -07:00
ieee802154 ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done 2018-12-11 09:33:11 +01:00
ipvlan
netdevsim bpf: add verifier callback to get stack usage info for offloaded progs 2018-10-08 10:24:12 +02:00
phy net: phy: Fix the issue that netif always links up after resuming 2018-12-18 21:48:15 -08:00
plip
ppp Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-10-25 16:43:35 -07:00
slip change semantics of ldisc ->compat_ioctl() 2018-10-13 00:50:53 -04:00
team team: no need to do team_notify_peers or team_mcast_rejoin when disabling port 2018-11-23 17:18:15 -08:00
usb qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup 2018-12-21 10:58:45 -08:00
vmxnet3
wan Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-10-24 14:43:41 +01:00
wimax
wireless wireless-drivers fixes for 4.20 2018-12-19 08:39:18 -08:00
xen-netback Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-10-03 21:00:17 -07:00
dummy.c
eql.c
geneve.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-10-19 11:03:06 -07:00
gtp.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c net: loopback: clear skb->tstamp before netif_rx() 2018-10-20 01:01:28 -07:00
macsec.c macsec: let the administrator set UP state even if lowerdev is down 2018-10-28 19:26:42 -07:00
macvlan.c macvlan: return correct error value 2018-12-03 16:02:43 -08:00
macvtap.c
Makefile
mdio.c
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c ntb_netdev: Simplify remove with client device drvdata 2018-10-31 21:20:05 -04:00
rionet.c rapidio/rionet: do not free skb before reading its length 2018-11-28 10:38:48 -08:00
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c
tun.c tun: remove skb access after netif_receive_skb 2018-12-03 14:10:27 -08:00
veth.c veth: Add ethtool statistics support for XDP 2018-10-15 21:58:46 -07:00
virtio_net.c virtio-net: keep vnet header zeroed after processing XDP 2018-11-30 17:25:03 -08:00
vrf.c ipv6: add vrf table handling code for ipv6 mcast 2018-10-02 22:29:08 -07:00
vsockmon.c
vxlan.c vxlan: changelink: Fix handling of default remotes 2018-12-18 21:18:26 -08:00
xen-netfront.c xen/netfront: tolerate frags with no data 2018-12-18 21:59:20 -08:00