From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 31FBF45BE1; Sat, 26 Oct 2024 16:34:40 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id B86784027A; Sat, 26 Oct 2024 16:34:39 +0200 (CEST) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) by mails.dpdk.org (Postfix) with ESMTP id 3666340265 for ; Sat, 26 Oct 2024 16:34:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1702; q=dns/txt; s=iport; t=1729953278; x=1731162878; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=cmEENUFhxHkp9Lbq0t/JVKdagrOIDQ3rakuqnemOClg=; b=Dw4TRisExNYqNIPK6Canab5QUVusO817K+ysTgqVYytU8cMbXKW68shS a2Pms32aEKMWmH6E0WsKqt4F+uaw+WgtbZ8jowvy0o9vulXrDdgPd6M11 g6MsG3j6ncSqWdTjuxfQsfsExRaPNOYlbZRP1oCeGMHJn4v7fzWGex/wo Y=; X-CSE-ConnectionGUID: yUsGGRq6Qq+liwCGNeO/AA== X-CSE-MsgGUID: E3oxYj1GTf+Uswjj8iPmig== X-IPAS-Result: =?us-ascii?q?A0AnAAB5/Rxn/5UQJK1aHAEBAQEBAQcBARIBAQQEAQGBf?= =?us-ascii?q?wcBAQsBgkqBT0NIjHKJUZ4YgSUDVg8BAQEPRAQBAYUHiigCJjQJDgECBAEBA?= =?us-ascii?q?QEDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4ThgiGXSsLAUaBDDETG4Jmg?= =?us-ascii?q?mUDrx+BeTOBAYR72TiBbIFIAY1FcIR3JxUGgUlEgRWCeW+LBwSKRIdBi2oli?= =?us-ascii?q?S+THEiBIQNZIQIRAVUTDQoLCQWJNYMmKYFrgQmDCIUlgWcJYYhHgQctgRGBH?= =?us-ascii?q?zqCA4E2SoNogUVHP4JNak43Ag0CN4IkgQCCT4dBQAMLGA1IESw1FBsGPm4Hr?= =?us-ascii?q?UFGgiRDAYEDCoFvAgdvk2OyToQkoT8aM6pKAZh3oyEzZ4RmgWc8gVlNIxWDI?= =?us-ascii?q?lIZD44tFtAeKjI7AgcLAQEDCZFeAQE?= IronPort-Data: A9a23:nAN+HKOonCo/LxXvrR3zlsFynXyQoLVcMsEvi/4bfWQNrUoggWECz WBJW2COOq6IMTP2KNAibYS+o0IAsMOAzoA1THM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeaphyFjmE+0/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WlrlV e/a+ZWFZAb9gWAsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6+RTF24ZB5RGw/80BWBR3 tM+JRdKRznW0opawJrjIgVtrs0nKM+uOMYUvWttiGiDS/0nWpvEBa7N4Le03h9p2ZsIRqiYP pRfMGY+BPjDS0Un1lM/EpczmPuvgFH0ciZTrxSeoq9fD237l1Mhgea0aoOJEjCMbegOmVapp Dvpw2q6PwoFNt7PyAKA833504cjmgu+Aur+DoaQ9PlhgFCVgGYeCAcbU0CTq+O+g0K1XNcZI EsRkgIioLYa+FSnTZ/6RRLQnZKflhcYX9wVF6gx7xuAj/OOpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOT9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:0w9296m8u5+2pxCHTkx5zOTi08rpDfIn3DAbv31ZSRFFG/FwWf rAoB19726QtN9/YhAdcLy7VZVoIkmsl6Kdn7NwAV7KZmCP0wGVxepZg7cKrQeNJ8SHzJ8/6U +lGJIOb+EZyjNB/KLH3DU= X-Talos-CUID: 9a23:GJ/Fem3T/4OurGdo0U53VbxfC/0+XVLn1SnpOgy8CHlCZ5uYbhi50fYx X-Talos-MUID: =?us-ascii?q?9a23=3APZ/dGA5Hp/87pBHu087yuc1kxoxFuKO+OUJUvqk?= =?us-ascii?q?I+PSfKi5yazaliTW4F9o=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.11,235,1725321600"; d="scan'208";a="378961214" Received: from alln-l-core-12.cisco.com ([173.36.16.149]) by alln-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 26 Oct 2024 14:34:36 +0000 Received: from eng-rtp-bld-31.cisco.com (eng-rtp-bld-31.cisco.com [172.18.47.81]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by alln-l-core-12.cisco.com (Postfix) with ESMTPS id 938B71800022A; Sat, 26 Oct 2024 14:34:36 +0000 (GMT) Received: by eng-rtp-bld-31.cisco.com (Postfix, from userid 51544) id 3944F14068AF; Sat, 26 Oct 2024 10:34:36 -0400 (EDT) From: Roger B Melton To: Jochen Behrens Cc: dev@dpdk.org, Roger B Melton Subject: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure Date: Sat, 26 Oct 2024 10:33:36 -0400 Message-Id: <20241026143336.2099168-1-rmelton@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Outbound-SMTP-Client: 172.18.47.81, eng-rtp-bld-31.cisco.com X-Outbound-Node: alln-l-core-12.cisco.com X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Problem: If vxmnet3_dev_configure() fails, applications may call vmxnet3_dev_close(). If the failure occurs before the vmxnet3 hw->shared structure is allocated the close will lead to a segv. Root Cause: This crash is due to incorrect adapter_stopped state in the vmxnet3 dev_private structure. When dev_private is allocated, adapter_stopped will be 0 (FALSE). eth_vmxnet3_dev_init() does not set it to TRUE, so it will remain FALSE until a successful vmxnet3_dev_start() followed by a vmxnet3_dev_stop(). When vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop(). vmxnet3_dev_stop() will check the adapter_stopped state in the vmxnet3 shared data, find it is FALSE and will proceed to stop the device, calling vmxnet3_disable_all_intrs(). vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data resulting in the segv. Solution: Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop processing. Signed-off-by: Roger B Melton --- drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c index 467fb61137..8d7f95a753 100644 --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c @@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev) /* Vendor and Device ID need to be set before init of shared code */ hw->device_id = pci_dev->id.device_id; hw->vendor_id = pci_dev->id.vendor_id; + hw->adapter_stopped = TRUE; hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr; hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr; -- 2.47.0