Whenever the igb driver detects the result of a read operation returns a value composed only by F's (like 0xFFFFFFFF), it will detach the net_device, clear the hw_addr pointer and warn to the user that adapter's link is lost - those steps happen on igb_rd32().
In case a PCI error happens on Power architecture, there's a recovery mechanism called EEH, that will reset the PCI slot and call driver's handlers to reset the adapter and network functionality as well. We observed that once hw_addr is NULL after the error is detected on igb_rd32(), it's never assigned back, so in the process of resetting the network functionality we got a NULL pointer dereference in both igb_configure_tx_ring() and igb_configure_rx_ring(). In order to avoid such bug, we re-assign the hw_addr value in the beginning of the function igb_reset(), in case the hw_addr is NULL when we reach that path. Reported-by: Anthony H. Thai <[email protected]> Reported-by: Harsha Thyagaraja <[email protected]> Signed-off-by: Guilherme G. Piccoli <[email protected]> --- drivers/net/ethernet/intel/igb/igb_main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index edc9a6a..c19119c 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -1873,6 +1873,13 @@ void igb_reset(struct igb_adapter *adapter) struct e1000_fc_info *fc = &hw->fc; u32 pba, hwm; + /* In case of PCI error, adapter might have lost its HW + * address; if we reached this point after an error scenario, + * we should re-assign the hw_addr based on the saved io_addr. + */ + if (!hw->hw_addr) + hw->hw_addr = adapter->io_addr; + /* Repartition Pba for greater than 9k mtu * To take effect CTRL.RST is required. */ -- 2.1.0
