Thomas Falcon 507ebe6444 ibmvnic: Fix use-after-free of VNIC login response buffer ... The login response buffer is freed after it is received and parsed, but other functions in the driver still attempt to read it, such as when the device is opened, causing the Oops below. Store relevant information in the driver's private data structures and use those instead. BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc00800000050a900 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: pseries_rng rng_core vmx_crypto gf128mul binfmt_misc ip_tables x_tables ibmvnic ibmveth crc32c_vpmsum autofs4 CPU: 7 PID: 759 Comm: NetworkManager Not tainted 5.9.0-rc1-00124-gd0a84e1f38d9 #14 NIP: c00800000050a900 LR: c00800000050a8f0 CTR: 00000000005b1904 REGS: c0000001ed746d20 TRAP: 0300 Not tainted (5.9.0-rc1-00124-gd0a84e1f38d9) MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 24428484 XER: 00000001 CFAR: c0000000000101b0 DAR: 0000000000000010 DSISR: 40000000 IRQMASK: 0 GPR00: c00800000050a8f0 c0000001ed746fb0 c008000000518e00 0000000000000000 GPR04: 00000000000000c0 0000000000000080 0003c366c60c4501 0000000000000352 GPR08: 000000000001f400 0000000000000010 0000000000000000 0000000000000000 GPR12: 0001cf0000000019 c00000001ec97680 00000001003dfd40 0000010008dbb22c GPR16: 0000000000000000 0000000000000000 0000000000000000 c000000000edb6c8 GPR20: c000000004e73e00 c000000004fd2448 c000000004e6d700 c000000004fd2448 GPR24: c000000004fd2400 c000000004a0cd20 c0000001ed961860 c0080000005029d8 GPR28: 0000000000000000 0000000000000003 c000000004a0c000 0000000000000000 NIP [c00800000050a900] init_resources+0x338/0xa00 [ibmvnic] LR [c00800000050a8f0] init_resources+0x328/0xa00 [ibmvnic] Call Trace: [c0000001ed746fb0] [c00800000050a8f0] init_resources+0x328/0xa00 [ibmvnic] (unreliable) [c0000001ed747090] [c00800000050b024] ibmvnic_open+0x5c/0x100 [ibmvnic] [c0000001ed747110] [c000000000bdcc0c] __dev_open+0x17c/0x250 [c0000001ed7471b0] [c000000000bdd1ec] __dev_change_flags+0x1dc/0x270 [c0000001ed747260] [c000000000bdd2bc] dev_change_flags+0x3c/0x90 [c0000001ed7472a0] [c000000000bf24b8] do_setlink+0x3b8/0x1280 [c0000001ed747450] [c000000000bf8cc8] __rtnl_newlink+0x5a8/0x980 [c0000001ed7478b0] [c000000000bf9110] rtnl_newlink+0x70/0xb0 [c0000001ed7478f0] [c000000000bf07c4] rtnetlink_rcv_msg+0x364/0x460 [c0000001ed747990] [c000000000c68b94] netlink_rcv_skb+0x84/0x1a0 [c0000001ed747a00] [c000000000bef758] rtnetlink_rcv+0x28/0x40 [c0000001ed747a20] [c000000000c68188] netlink_unicast+0x218/0x310 [c0000001ed747a80] [c000000000c6848c] netlink_sendmsg+0x20c/0x4e0 [c0000001ed747b20] [c000000000b9dc88] ____sys_sendmsg+0x158/0x360 [c0000001ed747bb0] [c000000000ba1c88] ___sys_sendmsg+0x98/0xf0 [c0000001ed747d10] [c000000000ba1db8] __sys_sendmsg+0x78/0x100 [c0000001ed747dc0] [c000000000033820] system_call_exception+0x160/0x280 [c0000001ed747e20] [c00000000000d740] system_call_common+0xf0/0x27c Instruction dump: 3be00000 38810068 b1410076 3941006a 93e10072 fbea0000 b1210068 4bff9915 eb9e0ca0 eabe0900 393c0010 3ab50048 <7fa04c2c> 7fba07b4 7b431764 7b4917a0 ---[ end trace fbc5949a28e103bd ]--- Fixes: f3ae59c0c0 ("ibmvnic: store RX and TX subCRQ handle array in ibmvnic_adapter struct") Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2020-08-24 15:56:57 -07:00
..
appletalk	docs: networking: move AppleTalk / LocalTalk drivers to the hw driver section	2020-06-26 16:08:45 -07:00
arcnet	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
bonding	bonding: fix active-backup failover for current ARP slave	2020-08-18 15:57:47 -07:00
caif	caif: fix cfv_netdev_tx()'s return type	2020-06-28 20:52:53 -07:00
can	treewide: Remove uninitialized_var() usage	2020-07-16 12:35:15 -07:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-08-23 11:48:27 -07:00
ethernet	ibmvnic: Fix use-after-free of VNIC login response buffer	2020-08-24 15:56:57 -07:00
fddi	net: fddi: skfp: cfm: Remove seemingly unused variable 'ID_sccs'	2020-08-14 20:42:25 -07:00
fjes
hamradio	docs: networking: move baycom to the hw driver section	2020-06-26 16:08:44 -07:00
hippi	hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path	2020-07-14 14:11:49 -07:00
hyperv	hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit()	2020-08-20 16:24:00 -07:00
ieee802154	net: ieee802154: adf7242: Replace HTTP links with HTTPS ones	2020-07-20 08:51:38 +02:00
ipa	remoteproc updates for v5.9	2020-08-11 11:17:45 -07:00
ipvlan	ipvlan: advertise link netns via netlink	2020-08-24 15:53:33 -07:00
netdevsim	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-08-03 18:27:40 -07:00
phy	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-08-23 11:48:27 -07:00
plip	net: plip: fix plip_tx_packet()'s return type	2020-06-28 20:52:53 -07:00
ppp	mm, treewide: rename kzfree() to kfree_sensitive()	2020-08-07 11:33:22 -07:00
slip	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
team	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
usb	r8152: Use MAC address from correct device tree node	2020-08-07 17:13:52 -07:00
vmxnet3	vmxnet3: use correct tcp hdr length when packet is encapsulated	2020-08-10 12:09:38 -07:00
wan	net: wan: dlci: Remove set but not used variable 'err'	2020-08-14 20:42:25 -07:00
wimax	wimax/i2400m: Fix potential urb refcnt leak	2020-04-18 15:00:22 -07:00
wireguard	netlink: consistently use NLA_POLICY_MIN_LEN()	2020-08-18 12:28:45 -07:00
wireless	rtl818x: constify ioreadX() iomem argument (as in generic implementation)	2020-08-14 19:56:57 -07:00
xen-netback	xen networking: add XDP offset adjustment to xen-netback	2020-07-01 15:25:14 -07:00
bareudp.c	tunnels: PMTU discovery support for directly bridged IP packets	2020-08-04 13:01:45 -07:00
dummy.c
eql.c
geneve.c	geneve: Support for PMTU discovery on directly bridged links	2020-08-04 13:01:45 -07:00
gtp.c	gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp()	2020-05-01 15:34:09 -07:00
ifb.c
Kconfig	xen networking: add basic XDP support for xen-netfront	2020-07-01 15:25:14 -07:00
LICENSE.SRC
loopback.c
macsec.c	netlink: consistently use NLA_POLICY_MIN_LEN()	2020-08-18 12:28:45 -07:00
macvlan.c	macvlan: validate setting of multiple remote source MAC addresses	2020-08-18 12:33:43 -07:00
macvtap.c
Makefile
mdio.c
mii.c
net_failover.c	net_failover: fixed rollback in net_failover_open()	2020-06-02 15:35:53 -07:00
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c	rionet: Fix use correct return type for ndo_start_xmit()	2020-04-30 12:15:13 -07:00
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-08-05 20:13:21 -07:00
tun.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-08-03 18:27:40 -07:00
veth.c	bpf, xdp: Remove XDP_QUERY_PROG and XDP_QUERY_PROG_HW XDP commands	2020-07-25 20:37:02 -07:00
virtio_net.c	virtio: fixes, features	2020-08-11 14:34:17 -07:00
vrf.c	vrf: Handle CONFIG_SYSCTL not set	2020-07-23 17:51:04 -07:00
vsockmon.c
vxlan.c	Revert "vxlan: fix tos value before xmit"	2020-08-05 12:09:10 -07:00
xen-netfront.c	bpf, xdp: Remove XDP_QUERY_PROG and XDP_QUERY_PROG_HW XDP commands	2020-07-25 20:37:02 -07:00