linux_dsm_epyc7002/drivers
Michael S. Tsirkin 3119815912 virtio: fix out of range array access
I have observed the following error on virtio-net module unload:

------------[ cut here ]------------
WARNING: at kernel/irq/manage.c:858 __free_irq+0xa0/0x14c()
Hardware name: Bochs
Trying to free already-free IRQ 0
Modules linked in: virtio_net(-) virtio_blk virtio_pci virtio_ring
virtio af_packet e1000 shpchp aacraid uhci_hcd ohci_hcd ehci_hcd [last
unloaded: scsi_wait_scan]
Pid: 1957, comm: rmmod Not tainted 2.6.33-rc8-vhost #24
Call Trace:
 [<ffffffff8103e195>] warn_slowpath_common+0x7c/0x94
 [<ffffffff8103e204>] warn_slowpath_fmt+0x41/0x43
 [<ffffffff810a7a36>] ? __free_pages+0x5a/0x70
 [<ffffffff8107cc00>] __free_irq+0xa0/0x14c
 [<ffffffff8107cceb>] free_irq+0x3f/0x65
 [<ffffffffa0081424>] vp_del_vqs+0x81/0xb1 [virtio_pci]
 [<ffffffffa0091d29>] virtnet_remove+0xda/0x10b [virtio_net]
 [<ffffffffa0075200>] virtio_dev_remove+0x22/0x4a [virtio]
 [<ffffffff812709ee>] __device_release_driver+0x66/0xac
 [<ffffffff81270ab7>] driver_detach+0x83/0xa9
 [<ffffffff8126fc66>] bus_remove_driver+0x91/0xb4
 [<ffffffff81270fcf>] driver_unregister+0x6c/0x74
 [<ffffffffa0075418>] unregister_virtio_driver+0xe/0x10 [virtio]
 [<ffffffffa0091c4d>] fini+0x15/0x17 [virtio_net]
 [<ffffffff8106997b>] sys_delete_module+0x1c3/0x230
 [<ffffffff81007465>] ? old_ich_force_enable_hpet+0x117/0x164
 [<ffffffff813bb720>] ? do_page_fault+0x29c/0x2cc
 [<ffffffff81028e58>] sysenter_dispatch+0x7/0x27
---[ end trace 15e88e4c576cc62b ]---

The bug is in virtio-pci: we use msix_vector as array index to get irq
entry, but some vqs do not have a dedicated vector so this causes an out
of bounds access.  By chance, we seem to often get 0 value, which
results in this error.

Fix by verifying that vector is legal before using it as index.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Anthony Liguori <aliguori@us.ibm.com>
Acked-by: Shirley Ma <xma@us.ibm.com>
Acked-by: Amit Shah <amit.shah@redhat.com>
2010-02-28 20:39:11 +02:00
..
accessibility
acpi Merge branch 'linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 2010-02-26 10:35:27 -08:00
amba
ata ahci: disable FPDMA auto-activate optimization on NVIDIA AHCI 2010-02-24 22:44:48 -05:00
atm
auxdisplay
base PM: Allow device drivers to use dpm_wait() 2010-02-26 20:39:11 +01:00
block Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2010-02-27 16:22:47 -08:00
bluetooth Bluetooth: Fix memory leak in Marvell BT-over-SDIO driver 2010-02-03 19:08:30 -08:00
cdrom
char Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2010-02-27 16:22:47 -08:00
clocksource Merge git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 2010-02-26 16:54:27 -08:00
connector connector: Delete buggy notification code. 2010-02-02 15:58:48 -08:00
cpufreq
cpuidle
crypto Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2010-02-26 16:50:02 -08:00
dca
dio
dma Merge branch 'sh/stable-updates' 2010-02-15 14:49:37 +09:00
edac Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp 2010-02-11 14:07:13 -08:00
eisa
firewire firewire: ohci: retransmit isochronous transmit packets on cycle loss 2010-02-14 15:10:41 +01:00
firmware drivers/firmware/iscsi_ibft.c: remove NIPQUAD_FMT, use %pI4 2010-02-26 21:02:14 +00:00
gpio
gpu Merge branch 'next-devicetree' of git://git.secretlab.ca/git/linux-2.6 2010-02-25 15:38:37 -08:00
hid Merge branches 'upstream', 'raw_report_modifications' and 'apple_magic_mouse' into for-linus 2010-02-25 17:39:16 +01:00
hwmon Merge commit 'origin/master' into next 2010-02-17 10:00:42 +11:00
i2c MIPS: I2C: Add driver for Cavium OCTEON I2C ports. 2010-02-27 12:53:05 +01:00
ide MIPS: Alchemy: change dbdma to accept physical memory addresses 2010-02-27 12:52:55 +01:00
idle
ieee1394
ieee802154
infiniband Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband 2010-02-11 14:01:25 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2010-02-22 08:48:06 -08:00
isdn PCI: push deprecated pci_find_device() function to last user 2010-02-22 16:17:01 -08:00
leds
lguest
macintosh Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2010-02-27 16:22:47 -08:00
mca
md dm: sysfs revert add empty release function to avoid debug warning 2010-02-16 18:43:04 +00:00
media Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 2010-02-26 17:16:20 -08:00
memstick
message Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6 2010-02-26 16:55:27 -08:00
mfd V4L/DVB: mfd: Add timb-radio to the timberdale MFD 2010-02-26 15:11:03 -03:00
misc
mmc MMC: AU1xMMC: Allow platforms to disable host capabilities 2010-02-27 12:53:19 +01:00
mtd MIPS: Alchemy: physmap-flash for all devboards 2010-02-27 12:52:59 +01:00
net Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2010-02-27 16:22:47 -08:00
nubus
of of: move definition of of_chosen into common code. 2010-02-14 07:13:55 -07:00
oprofile
parisc
parport
pci PM: Allow PCI devices to suspend/resume asynchronously 2010-02-26 20:39:12 +01:00
pcmcia Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus 2010-02-27 16:19:22 -08:00
platform toshiba_acpi: Add full hotkey support 2010-02-25 15:20:54 -05:00
pnp
power wm97xx_battery: Handle missing platform data gracefully 2010-01-29 17:00:18 +03:00
pps
ps3 powerpc: Remove trailing space in messages 2010-02-09 13:56:23 +11:00
rapidio
regulator regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() 2010-02-12 11:39:49 +00:00
rtc rtc: Add MPC5121 Real time clock driver 2010-02-16 10:47:35 -07:00
s390 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 2010-02-27 16:20:17 -08:00
sbus Merge commit 'v2.6.33-rc5' into secretlab/test-devicetree 2010-01-28 14:38:25 -07:00
scsi mac68k: move mac_esp platform device 2010-02-27 18:31:10 +01:00
serial Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2010-02-27 16:22:47 -08:00
sfi
sh sh: Use dummy_irq_chip for INTC redirect vectors. 2010-02-17 12:37:42 +09:00
sn
spi MIPS: Alchemy: change dbdma to accept physical memory addresses 2010-02-27 12:52:55 +01:00
ssb ssb: Fix CONFIG_SSB_SDIOHOST typo 2010-02-03 16:55:20 -05:00
staging Staging: Octeon: Remove /proc/octeon_ethernet_stats 2010-02-27 12:53:30 +01:00
tc
telephony
thermal
uio
usb PM: Allow USB devices to suspend/resume asynchronously 2010-02-26 20:39:12 +01:00
uwb
video Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2010-02-27 16:22:47 -08:00
virtio virtio: fix out of range array access 2010-02-28 20:39:11 +02:00
vlynq
w1
watchdog MIPS: AR7: Implement clock API 2010-02-27 12:53:16 +01:00
xen
zorro
Kconfig
Makefile