Rahul Lakkireddy ea8608d401 cxgb4: fix refcount init for TC-MQPRIO offload ... Properly initialize refcount to 1 when hardware queue arrays for TC-MQPRIO offload have been freshly allocated. Otherwise, following warning is observed. Also fix up error path to only free hardware queue arrays when refcount reaches 0. [ 130.075342] ------------[ cut here ]------------ [ 130.075343] refcount_t: addition on 0; use-after-free. [ 130.075355] WARNING: CPU: 0 PID: 10870 at lib/refcount.c:25 refcount_warn_saturate+0xe1/0x100 [ 130.075356] Modules linked in: sch_mqprio iptable_nat ib_iser libiscsi scsi_transport_iscsi ib_ipoib rdma_ucm ib_umad iw_cxgb4 libcxgb ib_uverbs x86_pkg_temp_thermal cxgb4 igb [ 130.075361] CPU: 0 PID: 10870 Comm: tc Kdump: loaded Not tainted 5.5.0-rc1+ #11 [ 130.075362] Hardware name: Supermicro X9SRE/X9SRE-3F/X9SRi/X9SRi-3F/X9SRE/X9SRE-3F/X9SRi/X9SRi-3F, BIOS 3.2 01/16/2015 [ 130.075363] RIP: 0010:refcount_warn_saturate+0xe1/0x100 [ 130.075364] Code: e8 14 41 c1 ff 0f 0b c3 80 3d 44 f4 10 01 00 0f 85 63 ff ff ff 48 c7 c7 38 9f 83 8c 31 c0 c6 05 2e f4 10 01 01 e8 ef 40 c1 ff <0f> 0b c3 48 c7 c7 10 9f 83 8c 31 c0 c6 05 17 f4 10 01 01 e8 d7 40 [ 130.075365] RSP: 0018:ffffa48d00c0b768 EFLAGS: 00010286 [ 130.075366] RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000001 [ 130.075366] RDX: 0000000000000001 RSI: 0000000000000096 RDI: ffff8a2e9fa187d0 [ 130.075367] RBP: ffff8a2e93890000 R08: 0000000000000398 R09: 000000000000003c [ 130.075367] R10: 00000000000142a0 R11: 0000000000000397 R12: ffffa48d00c0b848 [ 130.075368] R13: ffff8a2e94746498 R14: ffff8a2e966f7000 R15: 0000000000000031 [ 130.075368] FS: 00007f689015f840(0000) GS:ffff8a2e9fa00000(0000) knlGS:0000000000000000 [ 130.075369] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.075369] CR2: 00000000006762a0 CR3: 00000007cf164005 CR4: 00000000001606f0 [ 130.075370] Call Trace: [ 130.075377] cxgb4_setup_tc_mqprio+0xbee/0xc30 [cxgb4] [ 130.075382] ? cxgb4_ethofld_restart+0x50/0x50 [cxgb4] [ 130.075384] ? pfifo_fast_init+0x7e/0xf0 [ 130.075386] mqprio_init+0x5f4/0x630 [sch_mqprio] [ 130.075389] qdisc_create+0x1bf/0x4a0 [ 130.075390] tc_modify_qdisc+0x1ff/0x770 [ 130.075392] rtnetlink_rcv_msg+0x28b/0x350 [ 130.075394] ? rtnl_calcit.isra.32+0x110/0x110 [ 130.075395] netlink_rcv_skb+0xc6/0x100 [ 130.075396] netlink_unicast+0x1db/0x330 [ 130.075397] netlink_sendmsg+0x2f5/0x460 [ 130.075399] ? _copy_from_user+0x2e/0x60 [ 130.075400] sock_sendmsg+0x59/0x70 [ 130.075401] ____sys_sendmsg+0x1f0/0x230 [ 130.075402] ? copy_msghdr_from_user+0xd7/0x140 [ 130.075403] ___sys_sendmsg+0x77/0xb0 [ 130.075404] ? ___sys_recvmsg+0x84/0xb0 [ 130.075406] ? __handle_mm_fault+0x377/0xaf0 [ 130.075407] __sys_sendmsg+0x53/0xa0 [ 130.075409] do_syscall_64+0x44/0x130 [ 130.075412] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 130.075413] RIP: 0033:0x7f688f13af10 [ 130.075414] Code: c3 48 8b 05 82 6f 2c 00 f7 db 64 89 18 48 83 cb ff eb dd 0f 1f 80 00 00 00 00 83 3d 8d d0 2c 00 00 75 10 b8 2e 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ae cc 00 00 48 89 04 24 [ 130.075414] RSP: 002b:00007ffe6c7d9988 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 130.075415] RAX: ffffffffffffffda RBX: 00000000006703a0 RCX: 00007f688f13af10 [ 130.075415] RDX: 0000000000000000 RSI: 00007ffe6c7d99f0 RDI: 0000000000000003 [ 130.075416] RBP: 000000005df38312 R08: 0000000000000002 R09: 0000000000008000 [ 130.075416] R10: 00007ffe6c7d93e0 R11: 0000000000000246 R12: 0000000000000000 [ 130.075417] R13: 00007ffe6c7e9c50 R14: 0000000000000001 R15: 000000000067c600 [ 130.075418] ---[ end trace 8fbb3bf36a8671db ]--- v2: - Move the refcount_set() closer to where the hardware queue arrays are being allocated. - Fix up error path to only free hardware queue arrays when refcount reaches 0. Fixes: 2d0cb84dd9 ("cxgb4: add ETHOFLD hardware queue support") Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-12-20 14:13:33 -08:00
..
3com
8390
adaptec
aeroflex
agere
alacritech
allwinner
alteon
altera	net: of_get_phy_mode: Change API to solve int/unit warnings	2019-11-04 11:21:25 -08:00
amazon	net: ena: fix napi handler misbehavior when the napi budget is zero	2019-12-10 17:54:55 -08:00
amd
apm
apple
aquantia	net: atlantic: Signedness bug in aq_vec_isr_legacy()	2019-11-13 14:29:28 -08:00
arc	net: of_get_phy_mode: Change API to solve int/unit warnings	2019-11-04 11:21:25 -08:00
atheros	net: ag71xx: fix compile warnings	2019-12-17 22:38:50 -08:00
aurora	net: of_get_phy_mode: Change API to solve int/unit warnings	2019-11-04 11:21:25 -08:00
broadcom	bnx2x: Fix logic to get total no. of PFs per engine	2019-12-14 12:59:16 -08:00
brocade
cadence	net: macb: fix probing of PHY not described in the dt	2019-12-19 17:32:21 -08:00
calxeda
cavium	net: thunderx: start phy before starting autonegotiation	2019-12-05 12:10:40 -08:00
chelsio	cxgb4: fix refcount init for TC-MQPRIO offload	2019-12-20 14:13:33 -08:00
cirrus	net: ep93xx_eth: fix mismatch of request_mem_region in remove	2019-11-15 12:42:09 -08:00
cisco
cortina	net: gemini: Fix memory leak in gmac_setup_txqs	2019-12-16 16:26:54 -08:00
davicom
dec
dlink
emulex	net: emulex: benet: indent a Kconfig depends continuation line	2019-11-30 12:25:26 -08:00
ezchip
faraday	Here's the main documentation changes for 5.5:	2019-12-02 11:51:02 -08:00
freescale	dpaa2-ptp: fix double free of the ptp_qoriq IRQ	2019-12-17 14:10:20 -08:00
fujitsu
google	gve: Fix the queue page list allocated pages count	2019-11-26 15:52:34 -08:00
hisilicon	net: hns3: fix VF ID issue for setting VF VLAN	2019-12-05 14:42:43 -08:00
huawei
i825xx
ibm	net/ibmvnic: Fix typo in retry check	2019-12-13 17:23:10 -08:00
intel	net/ixgbe: Fix concurrency issues between config flow and XSK	2019-12-19 16:20:49 +01:00
marvell	net: marvell: mvpp2: phylink requires the link interrupt	2019-12-14 10:11:36 -08:00
mediatek	net: phylink: rename mac_link_state() op to mac_pcs_get_state()	2019-11-23 16:13:39 -08:00
mellanox	net/mlx5e: Fix concurrency issues between config flow and XSK	2019-12-19 16:20:49 +01:00
micrel
microchip	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-16 21:51:42 -08:00
moxa
mscc	net: mscc: ocelot: unregister the PTP clock on deinit	2019-12-03 11:27:00 -08:00
myricom
natsemi
neterion
netronome	nfp: flower: fix stats id allocation	2019-12-17 22:49:10 -08:00
ni	net: of_get_phy_mode: Change API to solve int/unit warnings	2019-11-04 11:21:25 -08:00
nvidia	net: forcedeth: add xmit_more support	2019-11-06 10:22:31 -08:00
nxp	lpc_eth: kernel BUG on remove	2019-12-06 20:51:19 -08:00
oki-semi
packetengines
pasemi
pensando	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-12-08 13:28:11 -08:00
qlogic	net: qlogic: Fix error paths in ql_alloc_large_buffers()	2019-12-17 22:01:07 -08:00
qualcomm	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-22 16:27:24 -08:00
rdc
realtek	r8169: fix rtl_hw_jumbo_disable for RTL8168evl	2019-12-07 14:23:06 -08:00
renesas	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-11-16 21:51:42 -08:00
rocker
samsung	net: of_get_phy_mode: Change API to solve int/unit warnings	2019-11-04 11:21:25 -08:00
seeq
sfc	sfc: fix build without CONFIG_RFS_ACCEL	2019-11-24 14:44:09 -08:00
sgi	net: sgi: ioc3-eth: ensure tx ring is 16k aligned.	2019-11-04 11:30:14 -08:00
silan
sis
smsc
socionext	net: of_get_phy_mode: Change API to solve int/unit warnings	2019-11-04 11:21:25 -08:00
stmicro	net: stmmac: Always arm TX Timer at end of transmission start	2019-12-18 12:04:18 -08:00
sun
synopsys
tehuti
ti	net: ethernet: ti: build cpsw-common for switchdev	2019-12-14 12:51:00 -08:00
toshiba
tundra
via
wiznet
xilinx	net: phylink: rename mac_link_state() op to mac_pcs_get_state()	2019-11-23 16:13:39 -08:00
xircom
xscale
dnet.c
dnet.h
ec_bhf.c
ethoc.c
fealnx.c
jme.c
jme.h
Kconfig	hp100: Move 100BaseVG AnyLAN driver to staging	2019-10-31 14:49:52 -07:00
korina.c
lantiq_etop.c
lantiq_xrx200.c
Makefile	hp100: Move 100BaseVG AnyLAN driver to staging	2019-10-31 14:49:52 -07:00