Commit 0333464f authored by Emil Tantilov's avatar Emil Tantilov Committed by Jeff Kirsher

ixgbevf: fix possible crashes in probe and remove

This patch resolves couple of issues in ixgbevf_probe/remove():

1. Fix a case where adapter->state is tested after free_netdev() this is
same as the patch for ixgbe from Daniel Borkmann <dborkman@redhat.com>:
commit b5b2ffc0 ("ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe")

2. Move pci_set_drvdata() after all the error checks in ixgbevf_probe() and
then add a check in ixgbevf_probe() to avoid running the cleanup functions
twice in cases where probe failed.

CC: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: default avatarEmil Tantilov <emil.s.tantilov@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 47068b0d
...@@ -3737,6 +3737,7 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) ...@@ -3737,6 +3737,7 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
struct ixgbe_hw *hw = NULL; struct ixgbe_hw *hw = NULL;
const struct ixgbevf_info *ii = ixgbevf_info_tbl[ent->driver_data]; const struct ixgbevf_info *ii = ixgbevf_info_tbl[ent->driver_data];
int err, pci_using_dac; int err, pci_using_dac;
bool disable_dev = false;
err = pci_enable_device(pdev); err = pci_enable_device(pdev);
if (err) if (err)
...@@ -3771,7 +3772,6 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) ...@@ -3771,7 +3772,6 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
SET_NETDEV_DEV(netdev, &pdev->dev); SET_NETDEV_DEV(netdev, &pdev->dev);
pci_set_drvdata(pdev, netdev);
adapter = netdev_priv(netdev); adapter = netdev_priv(netdev);
adapter->netdev = netdev; adapter->netdev = netdev;
...@@ -3860,6 +3860,7 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) ...@@ -3860,6 +3860,7 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (err) if (err)
goto err_register; goto err_register;
pci_set_drvdata(pdev, netdev);
netif_carrier_off(netdev); netif_carrier_off(netdev);
ixgbevf_init_last_counter_stats(adapter); ixgbevf_init_last_counter_stats(adapter);
...@@ -3889,12 +3890,13 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) ...@@ -3889,12 +3890,13 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
ixgbevf_reset_interrupt_capability(adapter); ixgbevf_reset_interrupt_capability(adapter);
iounmap(adapter->io_addr); iounmap(adapter->io_addr);
err_ioremap: err_ioremap:
disable_dev = !test_and_set_bit(__IXGBEVF_DISABLED, &adapter->state);
free_netdev(netdev); free_netdev(netdev);
err_alloc_etherdev: err_alloc_etherdev:
pci_release_regions(pdev); pci_release_regions(pdev);
err_pci_reg: err_pci_reg:
err_dma: err_dma:
if (!test_and_set_bit(__IXGBEVF_DISABLED, &adapter->state)) if (!adapter || disable_dev)
pci_disable_device(pdev); pci_disable_device(pdev);
return err; return err;
} }
...@@ -3911,7 +3913,13 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) ...@@ -3911,7 +3913,13 @@ static int ixgbevf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
static void ixgbevf_remove(struct pci_dev *pdev) static void ixgbevf_remove(struct pci_dev *pdev)
{ {
struct net_device *netdev = pci_get_drvdata(pdev); struct net_device *netdev = pci_get_drvdata(pdev);
struct ixgbevf_adapter *adapter = netdev_priv(netdev); struct ixgbevf_adapter *adapter;
bool disable_dev;
if (!netdev)
return;
adapter = netdev_priv(netdev);
set_bit(__IXGBEVF_REMOVING, &adapter->state); set_bit(__IXGBEVF_REMOVING, &adapter->state);
...@@ -3931,9 +3939,10 @@ static void ixgbevf_remove(struct pci_dev *pdev) ...@@ -3931,9 +3939,10 @@ static void ixgbevf_remove(struct pci_dev *pdev)
hw_dbg(&adapter->hw, "Remove complete\n"); hw_dbg(&adapter->hw, "Remove complete\n");
disable_dev = !test_and_set_bit(__IXGBEVF_DISABLED, &adapter->state);
free_netdev(netdev); free_netdev(netdev);
if (!test_and_set_bit(__IXGBEVF_DISABLED, &adapter->state)) if (disable_dev)
pci_disable_device(pdev); pci_disable_device(pdev);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment