linux-stable.git/drivers/net/ethernet/intel, branch linux-3.17.y

ixgbe: fix use after free adapter->state test in ixgbe_remove/ixgbe_probe

2014-12-06T23:57:32+00:00

commit b5b2ffc0574e1f271d79b6b992ee382dc9d5eaa8 upstream.

While working on a different issue, I noticed an annoying use
after free bug on my machine when unloading the ixgbe driver:

[ 8642.318797] ixgbe 0000:02:00.1: removed PHC on p2p2
[ 8642.742716] ixgbe 0000:02:00.1: complete
[ 8642.743784] BUG: unable to handle kernel paging request at ffff8807d3740a90
[ 8642.744828] IP: [] ixgbe_remove+0xfc/0x1b0 [ixgbe]
[ 8642.745886] PGD 20c6067 PUD 81c1f6067 PMD 81c15a067 PTE 80000007d3740060
[ 8642.746956] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[ 8642.748039] Modules linked in: [...]
[ 8642.752929] CPU: 1 PID: 1225 Comm: rmmod Not tainted 3.18.0-rc2+ #49
[ 8642.754203] Hardware name: Supermicro X10SLM-F/X10SLM-F, BIOS 1.1b 11/01/2013
[ 8642.755505] task: ffff8807e34d3fe0 ti: ffff8807b7204000 task.ti: ffff8807b7204000
[ 8642.756831] RIP: 0010:[]  [] ixgbe_remove+0xfc/0x1b0 [ixgbe]
[...]
[ 8642.774335] Stack:
[ 8642.775805]  ffff8807ee824098 ffff8807ee824098 ffffffffa01f3000 ffff8807ee824000
[ 8642.777326]  ffff8807b7207e18 ffffffff8137720f ffff8807ee824098 ffff8807ee824098
[ 8642.778848]  ffffffffa01f3068 ffff8807ee8240f8 ffff8807b7207e38 ffffffff8144180f
[ 8642.780365] Call Trace:
[ 8642.781869]  [] pci_device_remove+0x3f/0xc0
[ 8642.783395]  [] __device_release_driver+0x7f/0xf0
[ 8642.784876]  [] driver_detach+0xb8/0xc0
[ 8642.786352]  [] bus_remove_driver+0x59/0xe0
[ 8642.787783]  [] driver_unregister+0x30/0x70
[ 8642.789202]  [] pci_unregister_driver+0x25/0xa0
[ 8642.790657]  [] ixgbe_exit_module+0x1c/0xc8e [ixgbe]
[ 8642.792064]  [] SyS_delete_module+0x132/0x1c0
[ 8642.793450]  [] ? do_notify_resume+0x61/0xa0
[ 8642.794837]  [] system_call_fastpath+0x12/0x17

The issue is that test_and_set_bit() done on adapter->state is being
performed *after* the netdevice has been freed via free_netdev().

When netdev is being allocated on initialization time, it allocates
a private area, here struct ixgbe_adapter, that resides after the
net_device structure. In ixgbe_probe(), the device init routine,
we set up the adapter after alloc_etherdev_mq() on the private area
and add a reference for the pci_dev as well via pci_set_drvdata().

Both in the error path of ixgbe_probe(), but also on module unload
when ixgbe_remove() is being called, commit 41c62843eb6a ("ixgbe:
Fix rcu warnings induced by LER") accesses adapter after free_netdev().
The patch stores the result in a bool and thus fixes above oops on my
side.

Fixes: 41c62843eb6a ("ixgbe: Fix rcu warnings induced by LER")
Cc: Mark Rustad 
Signed-off-by: Daniel Borkmann 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

ixgbe: Correctly disable VLAN filter in promiscuous mode

2014-12-06T23:57:32+00:00

commit 4556dc591691fca743518edb24f15fbc83b5c8ef upstream.

IXGBE adapter seems to require that VLAN filtering be enabled if
VMDQ or SRIOV are enabled.  When those functions are disabled,
VLAN filtering may be disabled in promiscuous mode.

Prior to commit a9b8943ee129 ("ixgbe: remove vlan_filter_disable
and enable functions")

The logic was correct.  However, after the commit the logic
got reversed and VLAN filtered in now turned on when VMDQ/SRIOV
is disabled.

This patch changes the condition to enable hw vlan filtered
when VMDQ or SRIOV is enabled.

Fixes: a9b8943ee129 ("ixgbe: remove vlan_filter_disable and enable functions")
CC: Jacob Keller 
Signed-off-by: Vladislav Yasevich 
Acked-by: Emil Tantilov 
Tested-by: Phil Schmitt 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

i40evf: Fix TSO and hw checksums for non-accelerated vlan packets.

2014-08-26T00:27:09+00:00

This device claims TSO and checksum support for vlans.  It also
allows a user to control vlan acceleration offloading.  As such,
it is possible to turn off vlan acceleration and configure a vlan
which will continue to support TSO and hw checksums.

In such situation the packet passed down the the device will contain
a vlan header and skb->protocol will be set to ETH_P_8021Q.
The device assumes that skb->protocol contains network protocol
value and uses that value to set up TSO and checksum information.
This results in corrupted frames sent on the wire.

This patch extract the protocol value correctly and corrects TSO
and checksums for non-accelerated traffic.

Fix this by using vlan_get_protocol() helper.

CC: Jeff Kirsher 
CC: Jesse Brandeburg 
CC: Bruce Allan 
CC: Carolyn Wyborny 
CC: Don Skidmore 
CC: Greg Rose 
CC: Alex Duyck 
CC: John Ronciak 
CC: Mitch Williams 
CC: Linux NICS 
CC: e1000-devel@lists.sourceforge.net
Signed-off-by: Vladislav Yasevich 
Signed-off-by: David S. Miller

i40e: Fix TSO and hw checksums for non-accelerated vlan packets.

2014-08-26T00:27:09+00:00

This device claims TSO and checksum support for vlans.  It also
allows a user to control vlan acceleration offloading.  As such,
it is possible to turn off vlan acceleration and configure a vlan
which will continue to support TSO and hw checksums.

In such situation the packet passed down the the device will contain
a vlan header and skb->protocol will be set to ETH_P_8021Q.
The device assumes that skb->protocol contains network protocol
value and uses that value to set up TSO and checksum information.
This results in corrupted frames sent on the wire.

This patch extract the protocol value correctly and corrects TSO
and checksums for non-accelerated traffic.

Fix this by using vlan_get_protocol() helper.

CC: Jeff Kirsher 
CC: Jesse Brandeburg 
CC: Bruce Allan 
CC: Carolyn Wyborny 
CC: Don Skidmore 
CC: Greg Rose 
CC: Alex Duyck 
CC: John Ronciak 
CC: Mitch Williams 
CC: Linux NICS 
CC: e1000-devel@lists.sourceforge.net
Signed-off-by: Vladislav Yasevich 
Signed-off-by: David S. Miller

e1000: Fix TSO for non-accelerated vlan traffic

2014-08-26T00:27:09+00:00

This device claims TSO and checksum support for vlans.  It also
allows a user to control vlan acceleration offloading.  As such,
it is possible to turn off vlan acceleration and configure a vlan
which will continue to support TSO.

In such situation the packet passed down the the device will contain
a vlan header and skb->protocol will be set to ETH_P_8021Q.
The device assumes that skb->protocol contains network protocol
value and uses that value to set up TSO and checksum information.
This will results in corrupted frames sent on the wire.

This patch extract the protocol value correctly and corrects TSO
for non-accelerated traffic.

CC: Jeff Kirsher 
CC: Jesse Brandeburg 
CC: Bruce Allan 
CC: Carolyn Wyborny 
CC: Don Skidmore 
CC: Greg Rose 
CC: Alex Duyck 
CC: John Ronciak 
CC: Mitch Williams 
CC: Linux NICS 
CC: e1000-devel@lists.sourceforge.net
Signed-off-by: Vladislav Yasevich 
Signed-off-by: David S. Miller

e1000e: Fix TSO with non-accelerated vlans

2014-08-26T00:27:09+00:00

This device claims  TSO support for vlans.  It also allows a
user to control vlan acceleration offloading.  As such, it is
possible to turn off vlan acceleration and configure a vlan
which will continue to support TSO.

In such situation the packet passed down the the device will contain
a vlan header and skb->protocol will be set to ETH_P_8021Q.
The device assumes that skb->protocol contains network protocol
value and uses that value to set up TSO information.  This results
in corrupted frames sent on the wire.  Corruptions include
incorrect IP total length and invalid IP checksum.

This patch extract the protocol value correctly and corrects TSO
for non-accelerated traffic.

CC: Jeff Kirsher 
CC: Jesse Brandeburg 
CC: Bruce Allan 
CC: Carolyn Wyborny 
CC: Don Skidmore 
CC: Greg Rose 
CC: Alex Duyck 
CC: John Ronciak 
CC: Mitch Williams 
CC: Linux NICS 
CC: e1000-devel@lists.sourceforge.net
Signed-off-by: Vladislav Yasevich 
Signed-off-by: David S. Miller

i40e: fix PTP bug

2014-08-15T11:00:39+00:00

The receive hang detection routine was never being run when
PTP was enabled.

Change-ID: I200f35b0f3190d31b595df89d678f4c8a2131ba0
Signed-off-by: Jesse Brandeburg 
Tested-by: Jim Young 
Signed-off-by: Jeff Kirsher

i40e: Fix a few potential VF dereferences

2014-08-15T10:50:37+00:00

In some functions we might be doing potential dereference
without a check. This patch puts the check in place for all these
functions. Also fix the "for loops" so that we increment VF at the
right place so that we always do it even if we are short-circuiting
the loop through continue.

Change-ID: Id4276cfb1e841031bb7b6d6790c414242f364a9f
Signed-off-by: Anjali Singhai Jain 
Tested-by: Jim Young 
Signed-off-by: Jeff Kirsher

i40e: Fix for recent kernel panic

2014-08-15T10:39:08+00:00

Whenever we get a Tx hang we issue a PFR, which means we send AQ
messages to VFS about the reset coming. Unfortunately with the recent
fix to be able to send messages to all VFS which earlier was not
happening at all we now are sending messages to not just the VFS that
are up but also to VFS that are not up.  AQ complains about this and
sends us an error in ARQ called LAN overflow event for a queue. We
check if the queue belongs to a VF and if it does we try to send a
vc_notify_vf_reset message to that VF. Well if the VF is not up/enabled
we will be entering this function with a non-active VF id. In this
function we were assuming VF struct is populated but it won't be if
the VF is not active.

Change-ID: Ic6733cda4582d3609fe6d83b2872bb2dcdc73f4a
Signed-off-by: Ashish N Shah 
Signed-off-by: Anjali Singhai Jain 
Tested-by: Jim Young 
Signed-off-by: Jeff Kirsher

Merge tag 'pci-v3.17-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci

2014-08-15T00:10:33+00:00

Pull DEFINE_PCI_DEVICE_TABLE removal from Bjorn Helgaas:
 "Part two of the PCI changes for v3.17:

    - Remove DEFINE_PCI_DEVICE_TABLE macro use (Benoit Taine)

  It's a mechanical change that removes uses of the
  DEFINE_PCI_DEVICE_TABLE macro.  I waited until later in the merge
  window to reduce conflicts, but it's possible you'll still see a few"

* tag 'pci-v3.17-changes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  PCI: Remove DEFINE_PCI_DEVICE_TABLE macro use