[5.4,004/111] atm: eni: dont release is never initialized

From: Tong Zhang <ztong0001@gmail.com>

From: Tong Zhang <ztong0001@gmail.com>

[ Upstream commit 4deb550bc3b698a1f03d0332cde3df154d1b6c1e ]

label err_eni_release is reachable when eni_start() fail.
In eni_start() it calls dev->phy->start() in the last step, if start()
fail we don't need to call phy->stop(), if start() is never called, we
neither need to call phy->stop(), otherwise null-ptr-deref will happen.

In order to fix this issue, don't call phy->stop() in label err_eni_release

[    4.875714] ==================================================================
[    4.876091] BUG: KASAN: null-ptr-deref in suni_stop+0x47/0x100 [suni]
[    4.876433] Read of size 8 at addr 0000000000000030 by task modprobe/95
[    4.876778]
[    4.876862] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #2
[    4.877290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd94
[    4.877876] Call Trace:
[    4.878009]  dump_stack+0x7d/0xa3
[    4.878191]  kasan_report.cold+0x10c/0x10e
[    4.878410]  ? __slab_free+0x2f0/0x340
[    4.878612]  ? suni_stop+0x47/0x100 [suni]
[    4.878832]  suni_stop+0x47/0x100 [suni]
[    4.879043]  eni_do_release+0x3b/0x70 [eni]
[    4.879269]  eni_init_one.cold+0x1152/0x1747 [eni]
[    4.879528]  ? _raw_spin_lock_irqsave+0x7b/0xd0
[    4.879768]  ? eni_ioctl+0x270/0x270 [eni]
[    4.879990]  ? __mutex_lock_slowpath+0x10/0x10
[    4.880226]  ? eni_ioctl+0x270/0x270 [eni]
[    4.880448]  local_pci_probe+0x6f/0xb0
[    4.880650]  pci_device_probe+0x171/0x240
[    4.880864]  ? pci_device_remove+0xe0/0xe0
[    4.881086]  ? kernfs_create_link+0xb6/0x110
[    4.881315]  ? sysfs_do_create_link_sd.isra.0+0x76/0xe0
[    4.881594]  really_probe+0x161/0x420
[    4.881791]  driver_probe_device+0x6d/0xd0
[    4.882010]  device_driver_attach+0x82/0x90
[    4.882233]  ? device_driver_attach+0x90/0x90
[    4.882465]  __driver_attach+0x60/0x100
[    4.882671]  ? device_driver_attach+0x90/0x90
[    4.882903]  bus_for_each_dev+0xe1/0x140
[    4.883114]  ? subsys_dev_iter_exit+0x10/0x10
[    4.883346]  ? klist_node_init+0x61/0x80
[    4.883557]  bus_add_driver+0x254/0x2a0
[    4.883764]  driver_register+0xd3/0x150
[    4.883971]  ? 0xffffffffc0038000
[    4.884149]  do_one_initcall+0x84/0x250
[    4.884355]  ? trace_event_raw_event_initcall_finish+0x150/0x150
[    4.884674]  ? unpoison_range+0xf/0x30
[    4.884875]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    4.885150]  ? unpoison_range+0xf/0x30
[    4.885352]  ? unpoison_range+0xf/0x30
[    4.885557]  do_init_module+0xf8/0x350
[    4.885760]  load_module+0x3fe6/0x4340
[    4.885960]  ? vm_unmap_ram+0x1d0/0x1d0
[    4.886166]  ? ____kasan_kmalloc.constprop.0+0x84/0xa0
[    4.886441]  ? module_frob_arch_sections+0x20/0x20
[    4.886697]  ? __do_sys_finit_module+0x108/0x170
[    4.886941]  __do_sys_finit_module+0x108/0x170
[    4.887178]  ? __ia32_sys_init_module+0x40/0x40
[    4.887419]  ? file_open_root+0x200/0x200
[    4.887634]  ? do_sys_open+0x85/0xe0
[    4.887826]  ? filp_open+0x50/0x50
[    4.888009]  ? fpregs_assert_state_consistent+0x4d/0x60
[    4.888287]  ? exit_to_user_mode_prepare+0x2f/0x130
[    4.888547]  do_syscall_64+0x33/0x40
[    4.888739]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[    4.889010] RIP: 0033:0x7ff62fcf1cf7
[    4.889202] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f71
[    4.890172] RSP: 002b:00007ffe6644ade8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[    4.890570] RAX: ffffffffffffffda RBX: 0000000000f2ca70 RCX: 00007ff62fcf1cf7
[    4.890944] RDX: 0000000000000000 RSI: 0000000000f2b9e0 RDI: 0000000000000003
[    4.891318] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001
[    4.891691] R10: 00007ff62fd55300 R11: 0000000000000246 R12: 0000000000f2b9e0
[    4.892064] R13: 0000000000000000 R14: 0000000000f2bdd0 R15: 0000000000000001
[    4.892439] ==================================================================

Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/atm/eni.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Message ID	20210329075615.337194777@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Tong Zhang <ztong0001@gmail.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 004/111] atm: eni: dont release is never initialized Date: Mon, 29 Mar 2021 09:57:12 +0200 Message-Id: <20210329075615.337194777@linuxfoundation.org> In-Reply-To: <20210329075615.186199980@linuxfoundation.org> References: <20210329075615.186199980@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,002/111] net: fec: ptp: avoid register access when ipg clock is disabled [5.4,003/111] powerpc/4xx: Fix build errors from mfdcr() [5.4,004/111] atm: eni: dont release is never initialized [5.4,005/111] atm: lanai: dont run lanai_dev_close if not open [5.4,006/111] Revert "r8152: adjust the settings about MAC clock speed down for RTL8153" [5.4,007/111] ALSA: hda: ignore invalid NHLT table [5.4,008/111] ixgbe: Fix memleak in ixgbe_configure_clsu32 [5.4,009/111] net: tehuti: fix error return code in bdx_probe() [5.4,010/111] net: intel: iavf: fix error return code of iavf_init_get_resources() [5.4,011/111] sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count [5.4,012/111] gianfar: fix jumbo packets+napi+rx overrun crash [5.4,013/111] cifs: ask for more credit on async read/write code paths [5.4,014/111] cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev [5.4,015/111] gpiolib: acpi: Add missing IRQF_ONESHOT [5.4,016/111] nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default [5.4,017/111] NFS: Correct size calculation for create reply length [5.4,018/111] net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch() [5.4,019/111] net: wan: fix error return code of uhdlc_init() [5.4,020/111] net: davicom: Use platform_get_irq_optional() [5.4,021/111] atm: uPD98402: fix incorrect allocation [5.4,022/111] atm: idt77252: fix null-ptr-dereference [5.4,023/111] cifs: change noisy error message to FYI [5.4,024/111] irqchip/ingenic: Add support for the JZ4760 [5.4,025/111] sparc64: Fix opcode filtering in handling of no fault loads [5.4,026/111] habanalabs: Call put_pid() when releasing control device [5.4,027/111] u64_stats,lockdep: Fix u64_stats_init() vs lockdep [5.4,028/111] regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck [5.4,029/111] drm/amd/display: Revert dram_clock_change_latency for DCN2.1 [5.4,030/111] drm/amdgpu: fb BO should be ttm_bo_type_device [5.4,031/111] drm/radeon: fix AGP dependency [5.4,032/111] nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() [5.4,033/111] nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted [5.4,034/111] nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a [5.4,035/111] nfs: we dont support removing system.nfs4_acl [5.4,036/111] block: Suppress uevent for hidden device when removed [5.4,037/111] ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls [5.4,038/111] ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign [5.4,039/111] netsec: restore phy power state after controller reset [5.4,040/111] platform/x86: intel-vbtn: Stop reporting SW_DOCK events [5.4,041/111] squashfs: fix inode lookup sanity checks [5.4,042/111] squashfs: fix xattr id and id lookup sanity checks [5.4,043/111] kasan: fix per-page tags for non-page_alloc pages [5.4,044/111] gcov: fix clang-11+ support [5.4,045/111] ACPI: video: Add missing callback back for Sony VPCEH3U1E [5.4,046/111] arm64: dts: ls1046a: mark crypto engine dma coherent [5.4,047/111] arm64: dts: ls1012a: mark crypto engine dma coherent [5.4,048/111] arm64: dts: ls1043a: mark crypto engine dma coherent [5.4,049/111] ARM: dts: at91-sama5d27_som1: fix phy address to 7 [5.4,050/111] integrity: double check iint_cache was initialized [5.4,051/111] dm verity: fix DM_VERITY_OPTS_MAX value [5.4,052/111] dm ioctl: fix out of bounds array access when no devices [5.4,053/111] bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD [5.4,054/111] veth: Store queue_mapping independently of XDP prog presence [5.4,055/111] libbpf: Fix INSTALL flag order [5.4,056/111] net/mlx5e: Dont match on Geneve options in case option masks are all zero [5.4,057/111] ipv6: fix suspecious RCU usage warning [5.4,058/111] macvlan: macvlan_count_rx() needs to be aware of preemption [5.4,059/111] net: sched: validate stab values [5.4,060/111] net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port [5.4,061/111] igc: Fix Pause Frame Advertising [5.4,062/111] igc: Fix Supported Pause Frame Link Setting [5.4,063/111] e1000e: add rtnl_lock() to e1000_reset_task [5.4,064/111] e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 [5.4,065/111] net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template [5.4,066/111] ftgmac100: Restart MAC HW once [5.4,067/111] selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed [5.4,068/111] netfilter: ctnetlink: fix dump of the expect mask attribute [5.4,069/111] tcp: relookup sock for RST+ACK packets handled by obsolete req sock [5.4,070/111] can: peak_usb: add forgotten supported devices [5.4,071/111] can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate [5.4,072/111] can: kvaser_pciefd: Always disable bus load reporting [5.4,073/111] can: c_can_pci: c_can_pci_remove(): fix use-after-free [5.4,074/111] can: c_can: move runtime PM enable/disable to c_can_platform [5.4,075/111] can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning [5.4,076/111] can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors [5.4,077/111] mac80211: fix rate mask reset [5.4,078/111] nfp: flower: fix pre_tun mask id allocation [5.4,079/111] libbpf: Use SOCK_CLOEXEC when opening the netlink socket [5.4,080/111] octeontx2-af: Fix irq free in rvu teardown [5.4,081/111] octeontx2-af: fix infinite loop in unmapping NPC counter [5.4,082/111] net: cdc-phonet: fix data-interface release on probe failure [5.4,083/111] r8152: limit the RX buffer size of RTL8153A for USB 2.0 [5.4,084/111] net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes [5.4,085/111] selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value [5.4,086/111] libbpf: Fix BTF dump of pointer-to-array-of-struct [5.4,087/111] drm/msm: fix shutdown hook in case GPU components failed to bind [5.4,088/111] arm64: kdump: update ppos when reading elfcorehdr [5.4,089/111] PM: runtime: Defer suspending suppliers [5.4,090/111] net/mlx5e: Fix error path for ethtool set-priv-flag [5.4,091/111] PM: EM: postpone creating the debugfs dir till fs_initcall [5.4,092/111] RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server [5.4,093/111] bpf: Dont do bpf_cgroup_storage_set() for kuprobe/tp programs [5.4,094/111] Revert "netfilter: x_tables: Switch synchronization to RCU" [5.4,095/111] netfilter: x_tables: Use correct memory barriers. [5.4,096/111] Revert "netfilter: x_tables: Update remaining dereference to RCU" [5.4,097/111] ACPI: scan: Rearrange memory allocation in acpi_device_add() [5.4,098/111] ACPI: scan: Use unique number for instance_no [5.4,099/111] perf auxtrace: Fix auxtrace queue conflict [5.4,100/111] block: recalculate segment count for multi-segment discards correctly [5.4,101/111] scsi: Revert "qla2xxx: Make sure that aborted commands are freed" [5.4,102/111] scsi: qedi: Fix error return code of qedi_alloc_global_queues() [5.4,103/111] scsi: mpt3sas: Fix error return code of mpt3sas_base_attach() [5.4,104/111] locking/mutex: Fix non debug version of mutex_lock_io_nested() [5.4,105/111] x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc() [5.4,106/111] can: dev: Move device back to init netns on owning netns delete [5.4,107/111] net: dsa: b53: VLAN filtering is global to all users [5.4,108/111] net: qrtr: fix a kernel-infoleak in qrtr_recvmsg() [5.4,109/111] mac80211: fix double free in ibss_leave [5.4,110/111] ext4: add reclaim checks to xattr code [5.4,111/111] can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"

[5.4,004/111] atm: eni: dont release is never initialized

Commit Message

Patch