linux_dsm_epyc7002/drivers/net
Justin Maggard 8c94ddbc13 net: mvneta: Fix memory use after free.
After changing an interface's MTU, then bringing the interface down and
back up again, I immediately saw tons of kernel messages like below.
The reason for this bad behavior is mvneta_rxq_drop_pkts(), which calls
dma_unmap_single() on already-freed memory.  So we need to switch the
order of those two operations.

[  152.388518] BUG: Bad page state in process ifconfig  pfn:1b518
[  152.388526] page:dff3dbc0 count:0 mapcount:0 mapping:  (null) index:0x0
[  152.395178] flags: 0x200(arch_1)
[  152.398441] page dumped because: PAGE_FLAGS_CHECK_AT_PREP flag set
[  152.398446] bad because of flags:
[  152.398450] flags: 0x200(arch_1)
[  152.401716] Modules linked in:
[  152.401728] CPU: 0 PID: 1453 Comm: ifconfig Tainted: P    B      O    4.1.12.armada.1 #1
[  152.401733] Hardware name: Marvell Armada 370/XP (Device Tree)
[  152.401749] [<c0015b1c>] (unwind_backtrace) from [<c0011d8c>] (show_stack+0x10/0x14)
[  152.401762] [<c0011d8c>] (show_stack) from [<c06aa68c>] (dump_stack+0x74/0x90)
[  152.401772] [<c06aa68c>] (dump_stack) from [<c0096c08>] (bad_page+0xc4/0x124)
[  152.401783] [<c0096c08>] (bad_page) from [<c0099378>] (get_page_from_freelist+0x4e4/0x644)
[  152.401794] [<c0099378>] (get_page_from_freelist) from [<c0099620>] (__alloc_pages_nodemask+0x148/0x784)
[  152.401805] [<c0099620>] (__alloc_pages_nodemask) from [<c00ac658>] (kmalloc_order+0x10/0x20)
[  152.401818] [<c00ac658>] (kmalloc_order) from [<c04c6f44>] (mvneta_rx_refill+0xc4/0xe8)
[  152.401830] [<c04c6f44>] (mvneta_rx_refill) from [<c04c96c0>] (mvneta_setup_rxqs+0x298/0x39c)
[  152.401842] [<c04c96c0>] (mvneta_setup_rxqs) from [<c04c9904>] (mvneta_open+0x3c/0x150)
[  152.401853] [<c04c9904>] (mvneta_open) from [<c0597764>] (__dev_open+0xac/0x124)
[  152.401864] [<c0597764>] (__dev_open) from [<c05979e4>] (__dev_change_flags+0x8c/0x148)
[  152.401875] [<c05979e4>] (__dev_change_flags) from [<c0597ac0>] (dev_change_flags+0x18/0x48)
[  152.401886] [<c0597ac0>] (dev_change_flags) from [<c060d308>] (devinet_ioctl+0x620/0x6d0)
[  152.401897] [<c060d308>] (devinet_ioctl) from [<c057d810>] (sock_ioctl+0x64/0x288)
[  152.401908] [<c057d810>] (sock_ioctl) from [<c00dcb7c>] (do_vfs_ioctl+0x78/0x608)
[  152.401918] [<c00dcb7c>] (do_vfs_ioctl) from [<c00dd170>] (SyS_ioctl+0x64/0x74)
[  152.401930] [<c00dd170>] (SyS_ioctl) from [<c000f3a0>] (ret_fast_syscall+0x0/0x3c)

Signed-off-by: Justin Maggard <jmaggard@netgear.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-11-09 21:48:14 -05:00
..
appletalk
arcnet arcnet/com20020: add LEDS_CLASS dependency 2015-11-03 11:29:56 -05:00
bonding bonding: fix panic on non-ARPHRD_ETHER enslave failure 2015-11-07 13:17:32 -05:00
caif net: caif: check return value of alloc_netdev 2015-11-09 11:31:13 -05:00
can Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-11-03 13:41:45 -05:00
cris
dsa net: dsa: mv88e6xxx: isolate unbridged ports 2015-11-05 13:37:23 -05:00
ethernet net: mvneta: Fix memory use after free. 2015-11-09 21:48:14 -05:00
fddi
fjes fjes: Delete an unnecessary check before the function call "vfree" 2015-11-07 13:17:31 -05:00
hamradio
hippi
hyperv
ieee802154 mrf24j40: remove trailing semicolon 2015-09-24 20:39:37 +02:00
ipvlan ipvlan: read direct ifindex instead of iflink 2015-10-22 06:39:08 -07:00
irda net: irda: pxaficp_ir: dmaengine conversion 2015-09-28 22:32:48 -07:00
phy Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-11-03 13:41:45 -05:00
plip
ppp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-11-03 13:41:45 -05:00
slip ppp, slip: Validate VJ compression slot parameters completely 2015-11-02 16:25:00 -05:00
team
usb USB: qmi_wwan: Add quirk for Quectel EC20 Mini PCIe module 2015-11-05 11:39:56 -05:00
vmxnet3 drivers/net: get rid of unnecessary initializations in .get_drvinfo() 2015-10-16 00:24:10 -07:00
wan
wimax
wireless Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-11-01 00:15:30 -04:00
xen-netback xen-netback: correctly check failed allocation 2015-10-18 19:37:29 -07:00
dummy.c net: dummy: add more features 2015-10-21 19:36:10 -07:00
eql.c
geneve.c geneve: add IPv6 bits to geneve_fill_metadata_dst 2015-10-30 12:10:54 +09:00
ifb.c
Kconfig net: Add IPv6 support to VRF device 2015-10-13 04:55:07 -07:00
LICENSE.SRC
loopback.c
macvlan.c ipv4: Pass struct net into ip_defrag and ip_check_defrag 2015-10-12 19:44:16 -07:00
macvtap.c macvtap: Resolve possible __might_sleep warning in macvtap_do_read() 2015-11-09 12:04:44 -05:00
Makefile
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tun.c tun: use sk_fullsock() before reading sk->sk_tsflags 2015-10-12 19:45:48 -07:00
veth.c
virtio_net.c
vrf.c net: Add IPv6 support to VRF device 2015-10-13 04:55:07 -07:00
vxlan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-10-24 06:54:12 -07:00
xen-netfront.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-10-24 06:54:12 -07:00