projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| b28724f3 SL |
1 | From 52fc647ff8f5c72cebe8191eb9633e93bb11c24e Mon Sep 17 00:00:00 2001 |
| 2 | From: Yonglong Liu <liuyonglong@huawei.com> | |
| 3 | Date: Thu, 4 Apr 2019 16:46:44 +0800 | |
| 4 | Subject: net: hns: Fix probabilistic memory overwrite when HNS driver | |
| 5 | initialized | |
| 6 | ||
| 7 | [ Upstream commit c0b0984426814f3a9251873b689e67d34d8ccd84 ] | |
| 8 | ||
| 9 | When reboot the system again and again, may cause a memory | |
| 10 | overwrite. | |
| 11 | ||
| 12 | [ 15.638922] systemd[1]: Reached target Swap. | |
| 13 | [ 15.667561] tun: Universal TUN/TAP device driver, 1.6 | |
| 14 | [ 15.676756] Bridge firewalling registered | |
| 15 | [ 17.344135] Unable to handle kernel paging request at virtual address 0000000200000040 | |
| 16 | [ 17.352179] Mem abort info: | |
| 17 | [ 17.355007] ESR = 0x96000004 | |
| 18 | [ 17.358105] Exception class = DABT (current EL), IL = 32 bits | |
| 19 | [ 17.364112] SET = 0, FnV = 0 | |
| 20 | [ 17.367209] EA = 0, S1PTW = 0 | |
| 21 | [ 17.370393] Data abort info: | |
| 22 | [ 17.373315] ISV = 0, ISS = 0x00000004 | |
| 23 | [ 17.377206] CM = 0, WnR = 0 | |
| 24 | [ 17.380214] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____) | |
| 25 | [ 17.386926] [0000000200000040] pgd=0000000000000000 | |
| 26 | [ 17.391878] Internal error: Oops: 96000004 [#1] SMP | |
| 27 | [ 17.396824] CPU: 23 PID: 95 Comm: kworker/u130:0 Tainted: G E 4.19.25-1.2.78.aarch64 #1 | |
| 28 | [ 17.414175] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.54 08/16/2018 | |
| 29 | [ 17.425615] Workqueue: events_unbound async_run_entry_fn | |
| 30 | [ 17.435151] pstate: 00000005 (nzcv daif -PAN -UAO) | |
| 31 | [ 17.444139] pc : __mutex_lock.isra.1+0x74/0x540 | |
| 32 | [ 17.453002] lr : __mutex_lock.isra.1+0x3c/0x540 | |
| 33 | [ 17.461701] sp : ffff000100d9bb60 | |
| 34 | [ 17.469146] x29: ffff000100d9bb60 x28: 0000000000000000 | |
| 35 | [ 17.478547] x27: 0000000000000000 x26: ffff802fb8945000 | |
| 36 | [ 17.488063] x25: 0000000000000000 x24: ffff802fa32081a8 | |
| 37 | [ 17.497381] x23: 0000000000000002 x22: ffff801fa2b15220 | |
| 38 | [ 17.506701] x21: ffff000009809000 x20: ffff802fa23a0888 | |
| 39 | [ 17.515980] x19: ffff801fa2b15220 x18: 0000000000000000 | |
| 40 | [ 17.525272] x17: 0000000200000000 x16: 0000000200000000 | |
| 41 | [ 17.534511] x15: 0000000000000000 x14: 0000000000000000 | |
| 42 | [ 17.543652] x13: ffff000008d95db8 x12: 000000000000000d | |
| 43 | [ 17.552780] x11: ffff000008d95d90 x10: 0000000000000b00 | |
| 44 | [ 17.561819] x9 : ffff000100d9bb90 x8 : ffff802fb89d6560 | |
| 45 | [ 17.570829] x7 : 0000000000000004 x6 : 00000004a1801d05 | |
| 46 | [ 17.579839] x5 : 0000000000000000 x4 : 0000000000000000 | |
| 47 | [ 17.588852] x3 : ffff802fb89d5a00 x2 : 0000000000000000 | |
| 48 | [ 17.597734] x1 : 0000000200000000 x0 : 0000000200000000 | |
| 49 | [ 17.606631] Process kworker/u130:0 (pid: 95, stack limit = 0x(____ptrval____)) | |
| 50 | [ 17.617438] Call trace: | |
| 51 | [ 17.623349] __mutex_lock.isra.1+0x74/0x540 | |
| 52 | [ 17.630927] __mutex_lock_slowpath+0x24/0x30 | |
| 53 | [ 17.638602] mutex_lock+0x50/0x60 | |
| 54 | [ 17.645295] drain_workqueue+0x34/0x198 | |
| 55 | [ 17.652623] __sas_drain_work+0x7c/0x168 | |
| 56 | [ 17.659903] sas_drain_work+0x60/0x68 | |
| 57 | [ 17.666947] hisi_sas_scan_finished+0x30/0x40 [hisi_sas_main] | |
| 58 | [ 17.676129] do_scsi_scan_host+0x70/0xb0 | |
| 59 | [ 17.683534] do_scan_async+0x20/0x228 | |
| 60 | [ 17.690586] async_run_entry_fn+0x4c/0x1d0 | |
| 61 | [ 17.697997] process_one_work+0x1b4/0x3f8 | |
| 62 | [ 17.705296] worker_thread+0x54/0x470 | |
| 63 | ||
| 64 | Every time the call trace is not the same, but the overwrite address | |
| 65 | is always the same: | |
| 66 | Unable to handle kernel paging request at virtual address 0000000200000040 | |
| 67 | ||
| 68 | The root cause is, when write the reg XGMAC_MAC_TX_LF_RF_CONTROL_REG, | |
| 69 | didn't use the io_base offset. | |
| 70 | ||
| 71 | Signed-off-by: Yonglong Liu <liuyonglong@huawei.com> | |
| 72 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
| 73 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
| 74 | --- | |
| 75 | drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c | 2 +- | |
| 76 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
| 77 | ||
| 78 | diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c | |
| 79 | index 51e7e9f5af49..70de7b5d28af 100644 | |
| 80 | --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c | |
| 81 | +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c | |
| 82 | @@ -129,7 +129,7 @@ static void hns_xgmac_lf_rf_control_init(struct mac_driver *mac_drv) | |
| 83 | dsaf_set_bit(val, XGMAC_UNIDIR_EN_B, 0); | |
| 84 | dsaf_set_bit(val, XGMAC_RF_TX_EN_B, 1); | |
| 85 | dsaf_set_field(val, XGMAC_LF_RF_INSERT_M, XGMAC_LF_RF_INSERT_S, 0); | |
| 86 | - dsaf_write_reg(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val); | |
| 87 | + dsaf_write_dev(mac_drv, XGMAC_MAC_TX_LF_RF_CONTROL_REG, val); | |
| 88 | } | |
| 89 | ||
| 90 | /** | |
| 91 | -- | |
| 92 | 2.20.1 | |
| 93 |