lkml.org 
[lkml]   [2020]   [Jun]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2 net 2/9] net: qed: fix async event callbacks unregistering
    Date
    qed_spq_unregister_async_cb() should be called before
    qed_rdma_info_free() to avoid crash-spawning uses-after-free.
    Instead of calling it from each subsystem exit code, do it in one place
    on PF down.

    Fixes: 291d57f67d24 ("qed: Fix rdma_info structure allocation")
    Signed-off-by: Alexander Lobakin <alobakin@marvell.com>
    Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
    Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
    ---
    drivers/net/ethernet/qlogic/qed/qed_dev.c | 9 +++++++--
    drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 2 --
    drivers/net/ethernet/qlogic/qed/qed_roce.c | 1 -
    3 files changed, 7 insertions(+), 5 deletions(-)

    diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
    index 1eebf30fa798..b41ada668948 100644
    --- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
    +++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
    @@ -1368,6 +1368,8 @@ static void qed_dbg_user_data_free(struct qed_hwfn *p_hwfn)

    void qed_resc_free(struct qed_dev *cdev)
    {
    + struct qed_rdma_info *rdma_info;
    + struct qed_hwfn *p_hwfn;
    int i;

    if (IS_VF(cdev)) {
    @@ -1385,7 +1387,8 @@ void qed_resc_free(struct qed_dev *cdev)
    qed_llh_free(cdev);

    for_each_hwfn(cdev, i) {
    - struct qed_hwfn *p_hwfn = &cdev->hwfns[i];
    + p_hwfn = cdev->hwfns + i;
    + rdma_info = p_hwfn->p_rdma_info;

    qed_cxt_mngr_free(p_hwfn);
    qed_qm_info_free(p_hwfn);
    @@ -1404,8 +1407,10 @@ void qed_resc_free(struct qed_dev *cdev)
    qed_ooo_free(p_hwfn);
    }

    - if (QED_IS_RDMA_PERSONALITY(p_hwfn))
    + if (QED_IS_RDMA_PERSONALITY(p_hwfn) && rdma_info) {
    + qed_spq_unregister_async_cb(p_hwfn, rdma_info->proto);
    qed_rdma_info_free(p_hwfn);
    + }

    qed_iov_free(p_hwfn);
    qed_l2_free(p_hwfn);
    diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
    index d2fe61a5cf56..5409a2da6106 100644
    --- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
    +++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
    @@ -2836,8 +2836,6 @@ int qed_iwarp_stop(struct qed_hwfn *p_hwfn)
    if (rc)
    return rc;

    - qed_spq_unregister_async_cb(p_hwfn, PROTOCOLID_IWARP);
    -
    return qed_iwarp_ll2_stop(p_hwfn);
    }

    diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
    index 4566815f7b87..7271dd7166e5 100644
    --- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
    +++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
    @@ -113,7 +113,6 @@ void qed_roce_stop(struct qed_hwfn *p_hwfn)
    break;
    }
    }
    - qed_spq_unregister_async_cb(p_hwfn, PROTOCOLID_ROCE);
    }

    static void qed_rdma_copy_gids(struct qed_rdma_qp *qp, __le32 *src_gid,
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-23 15:55    [W:2.278 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site