• Selvin Xavier's avatar
    bnxt_en: Fix the double free during device removal · 89b59a84
    Selvin Xavier authored
    Following warning reported by KASAN during driver unload
    
    ==================================================================
    BUG: KASAN: double-free in bnxt_remove_one+0x103/0x200 [bnxt_en]
    Free of addr ffff88814e8dd4c0 by task rmmod/17469
    CPU: 47 PID: 17469 Comm: rmmod Kdump: loaded Tainted: G S                 6.2.0-rc7+ #2
    Hardware name: Dell Inc. PowerEdge R740/01YM03, BIOS 2.3.10 08/15/2019
    Call Trace:
     <TASK>
     dump_stack_lvl+0x33/0x46
     print_report+0x17b/0x4b3
     ? __call_rcu_common.constprop.79+0x27e/0x8c0
     ? __pfx_free_object_rcu+0x10/0x10
     ? __virt_addr_valid+0xe3/0x160
     ? bnxt_remove_one+0x103/0x200 [bnxt_en]
     kasan_report_invalid_free+0x64/0xd0
     ? bnxt_remove_one+0x103/0x200 [bnxt_en]
     ? bnxt_remove_one+0x103/0x200 [bnxt_en]
     __kasan_slab_free+0x179/0x1c0
     ? bnxt_remove_one+0x103/0x200 [bnxt_en]
     __kmem_cache_free+0x194/0x350
     bnxt_remove_one+0x103/0x200 [bnxt_en]
     pci_device_remove+0x62/0x110
     device_release_driver_internal+0xf6/0x1c0
     driver_detach+0x76/0xe0
     bus_remove_driver+0x89/0x160
     pci_unregister_driver+0x26/0x110
     ? strncpy_from_user+0x188/0x1c0
     bnxt_exit+0xc/0x24 [bnxt_en]
     __x64_sys_delete_module+0x21f/0x390
     ? __pfx___x64_sys_delete_module+0x10/0x10
     ? __pfx_mem_cgroup_handle_over_high+0x10/0x10
     ? _raw_spin_lock+0x87/0xe0
     ? __pfx__raw_spin_lock+0x10/0x10
     ? __audit_syscall_entry+0x185/0x210
     ? ktime_get_coarse_real_ts64+0x51/0x80
     ? syscall_trace_enter.isra.18+0x126/0x1a0
     do_syscall_64+0x37/0x90
     entry_SYSCALL_64_after_hwframe+0x72/0xdc
    RIP: 0033:0x7effcb6fd71b
    Code: 73 01 c3 48 8b 0d 6d 17 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 3d 17 2c 00 f7 d8 64 89 01 48
    RSP: 002b:00007ffeada270b8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
    RAX: ffffffffffffffda RBX: 00005623660e0750 RCX: 00007effcb6fd71b
    RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005623660e07b8
    RBP: 0000000000000000 R08: 00007ffeada26031 R09: 0000000000000000
    R10: 00007effcb771280 R11: 0000000000000206 R12: 00007ffeada272e0
    R13: 00007ffeada28bc4 R14: 00005623660e02a0 R15: 00005623660e0750
     </TASK>
    
    Auxiliary device structures are freed in bnxt_aux_dev_release. So avoid
    calling kfree from bnxt_remove_one.
    
    Also, set bp->edev to NULL before freeing the auxilary private structure.
    
    Fixes: d80d88b0 ("bnxt_en: Add auxiliary driver support")
    Reviewed-by: default avatarAjit Khaparde <ajit.khaparde@broadcom.com>
    Reviewed-by: default avatarAndy Gospodarek <andrew.gospodarek@broadcom.com>
    Signed-off-by: default avatarSelvin Xavier <selvin.xavier@broadcom.com>
    Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    89b59a84
bnxt.c 365 KB